Atomic Runtime Inspection via Copy-on-Write Memory Snapshotting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current runtime integrity measurement methods face challenges in ensuring atomicity and quiescence, leading to potential false positives and negatives, and impose significant performance penalties on the target system, including denial-of-service and high memory overhead.
Innovation Solution
Implementing a copy-on-write (CoW) process to generate copies of memory pages being written to, allowing the measurement agent to observe the target's memory state at a particular moment in time without disrupting the target's operation, thereby ensuring atomicity and reducing downtime and resource usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If runtime integrity measurement is performed on a running process, then fresher and more confident assertions about the target's state are obtained, but coherency issues arise leading to false positives and false negatives
Solution Approach 1:
The system performs preliminary actions by pausing the target process before measurement and restoring it after measurement. This ensures that the measurement is taken from a consistent state snapshot, preventing false positives and false negatives by ensuring atomicity of the measurement operation.
Solution Approach 2:
The system creates a copy of the target process's memory state during measurement. This copy allows the measurement agent to analyze the process state without disrupting the running process, ensuring coherency while maintaining the ability to perform runtime measurements on living processes.
2Measurement precision
If the target process is paused during measurement to ensure atomicity, then measurement coherency is improved, but productivity and target performance deteriorate due to denial-of-service
Solution Approach 1:
The system performs preliminary pausing only for the minimal time necessary to capture a consistent snapshot of the process state. This brief pause ensures atomicity measurement while minimizing impact on target performance and productivity.
Solution Approach 2:
The system rapidly performs the measurement operation once the process is paused, minimizing the duration of the pause. This rushing through the measurement process reduces the denial-of-service impact while still ensuring atomicity through the pause-measure-restore sequence.
3Measurement precision
If memory is copied to ensure atomic measurement, then measurement coherency is improved, but memory overhead increases
Solution Approach 1:
The system creates a copy of the target process's memory space to perform measurements. This copy enables atomic measurement of the running process state without requiring the process to be fully stopped, balancing measurement precision with acceptable memory overhead.
Solution Approach 2:
The system creates temporary copies of memory pages only when needed for measurement, and these copies are discarded after measurement completes. This approach uses memory resources efficiently by creating short-living objects only when necessary for the measurement operation.
Data Source
AI summary
A method for achieving atomicity while inspecting a running computer process using a copy-on-write process in a supervisor to generate a copy of a target's memory page being written to, prior to executing the write, the copy along with any unwritten to memory pages in the target being mapped to a measurement agent (MA) and used to reflect the state of the target at a particular moment in time which state when observed by the MA provides an atomic runtime inspection.