Below-OS Hypervisor for Malware Interception Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer network protection systems are inadequate in preventing malware from intercepting sensitive information and disabling network filters, leading to data theft and loss of privacy, especially in online services like banking and e-commerce.
Innovation Solution
A network regulator system that uses hardware virtualization to launch a hypervisor on client systems, which creates a client virtual machine, loads an operating system, and verifies the integrity of the hypervisor, allowing or blocking communications based on its trusted state, ensuring secure data exchange.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional network protection systems are used, then network communication can be maintained, but malware can intercept sensitive information and disable network filters
Solution Approach 1:
The system segments the client system into two distinct execution environments: a hypervisor layer and a guest operating system layer. The hypervisor runs in a privileged mode below the OS, creating separate security domains. This segmentation isolates the security-critical hypervisor from malware that may infect the guest OS, preventing malware from intercepting sensitive information while maintaining network communication functionality.
Solution Approach 2:
The patent introduces a new dimensional layer in the system architecture by implementing a hypervisor that operates below the traditional operating system layer. This 'below-OS' dimension creates an additional security boundary that traditional network protection systems lack. The hypervisor monitors and controls system calls, network communications, and hardware access from this new layer, effectively blocking malware interception attempts that occur at the traditional OS level.
2Reliability
If a hypervisor is launched to verify integrity, then trusted state can be confirmed, but system complexity increases
Solution Approach 1:
The hypervisor implements self-verification capabilities through integrity measurement and validation mechanisms. The system automatically measures the hypervisor's own integrity state and provides this information to the network regulator without requiring manual intervention. This self-service approach to integrity verification reduces the operational complexity despite the increased architectural complexity, as the system manages its own security validation autonomously.
Solution Approach 2:
The network regulator acts as an intermediary between the hypervisor and the network, verifying the hypervisor's integrity state before allowing network communications. This intermediary layer simplifies the overall system by centralizing the complex integrity verification logic in a dedicated component rather than distributing it throughout the entire system, making the verification process more manageable despite the added architectural layer.
3Object-affected harmful factors
If network filter is blocked by malware, then communication security is compromised, but adding hypervisor layer increases resource consumption
Solution Approach 1:
The patent extracts the network filter functionality from the guest operating system and relocates it to the hypervisor layer. By taking out the network filtering capability from the OS level (where malware can disable it) and placing it in the hypervisor layer (which runs below the OS), the system prevents malware from blocking network filters while maintaining efficient communication control. The hypervisor directly manages network packet filtering without requiring OS-level software, reducing the resource overhead of multiple software layers.
Solution Approach 2:
The system replaces software-based network filtering (which consumes significant CPU resources and can be disabled by malware) with hardware-assisted virtualization mechanisms. The hypervisor leverages hardware virtualization features to enforce network policies and filter traffic at a lower level, reducing the processing burden on the CPU compared to traditional software-based network filters running in the OS.
Data Source
AI summary
Described systems and methods allow protecting a client system, such as a computer system or smartphone, from malware. In some embodiments, a network regulator device is used to distribute a bootable image of a hypervisor, on demand, to each of a set of client systems connected to a network. After booting on a client system, the hypervisor loads the local OS and applications into a virtual machine. Integrity measurements of the hypervisor and/or OS are sent to the network regulator for verification. When the network regulator determines that software executing on a client system, such as the hypervisor and/or the OS, are not in a trusted state, the network regulator may block access of the respective client system to the network.