Bus Device Kernel Integrity Inspection for Virtual Machines
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Electronic devices with virtual machines (VMs) are vulnerable to malware attacks that compromise guest OS kernels, as existing management controllers cannot perform integrity inspection of kernels in VMs, allowing rootkits to hide and persist, leading to potential unauthorized access and data corruption.
Innovation Solution
A bus device with a device controller performing I/O virtualization is used to obtain kernel information from guest OSes for integrity inspection, bypassing the hypervisor and enabling detection of compromised kernels, thereby preventing unauthorized access and data loss.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a management controller is used to perform integrity inspection of OS kernels, then kernel integrity can be monitored in non-virtualized systems, but the management controller cannot perform integrity inspection of kernels in virtual machines
Solution Approach 1:
A kernel inspector device is introduced as an intermediary component between the management controller and the virtual machine kernels. This device includes a virtualization component that interfaces with the hypervisor and an inspection component that can directly access and inspect kernel information in VMs, thereby extending integrity inspection capabilities to virtualized environments without requiring changes to the core management controller architecture
Solution Approach 2:
The kernel inspector device is segmented into distinct functional components: a virtualization component that handles communication with the hypervisor and VMs, and an inspection component that performs the actual integrity checking. This segmentation allows the system to maintain compatibility with existing virtualized environments while adding new inspection capabilities
2Adaptability or versatility
If the hypervisor is used to manage VMs, then virtualization and resource management are achieved, but the hypervisor can intercept and prevent direct access to kernel information for inspection
Solution Approach 1:
The kernel inspector device acts as an intermediary that the hypervisor is configured to communicate with. The virtualization component of the inspector device establishes a communication channel with the hypervisor, allowing the inspection component to access kernel information through the hypervisor without being blocked, as the hypervisor is explicitly configured to direct kernel information to the inspector device
Solution Approach 2:
The system establishes a feedback loop where the hypervisor receives configuration information specifying the communication channel to the kernel inspector device, and the inspector device uses this channel to retrieve kernel information. The hypervisor's configuration is updated to include the inspector device as a trusted component, creating a feedback mechanism that enables controlled access
3Object-generated harmful factors
If rootkits are inserted into guest OS kernels, then malware can hide and persist in the system, but existing inspection methods cannot detect compromised kernels in VMs
Solution Approach 1:
The inspection component performs integrity inspection of kernel information by comparing it against known good states or checking for anomalies before malware can fully establish its presence. The system can detect rootkits by identifying modifications to kernel code or structure, preventing malware from successfully hiding and persisting
Solution Approach 2:
The system replaces traditional mechanical inspection methods with direct memory access techniques. The inspection component can directly read kernel information from the VM's memory space through the established communication channel, bypassing the need for software-based inspection that could be fooled by rootkits
Data Source
AI summary
In some examples, a bus device includes a device controller to perform input/output (I/O) virtualization to provide a virtualized instance of the bus device. The device controller establishes a channel between the virtualized instance of the bus device and a guest operating system (OS) of a virtual machine (VM). The device controller receives, from the VM, address information relating to a portion of a memory containing information associated with a kernel of the guest OS, and obtains, for integrity inspection, the information associated with the kernel from the memory based on the address information.