Driver Code Segmentation in Separate Protection Domains
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing driver execution systems face challenges in reliability, performance, and security due to the potential for defective or malicious drivers to compromise system integrity, particularly when executing in privileged modes like kernel mode.
Innovation Solution
A system that loads a driver in a first domain and a companion in a second, secure domain, facilitating communication between the two while managing their lifetime, thereby enhancing reliability and security without increasing complexity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the driver executes in kernel mode with privileged access to system resources, then the driver can control device resources effectively, but the system becomes vulnerable to crashes and data corruption from defective or malicious drivers
Solution Approach 1:
The driver is segmented into two parts: a kernel-mode driver that handles device control and a user-mode companion that performs sensitive operations. This segmentation isolates the harmful effects to the user-mode companion, preventing system-wide crashes while maintaining device control capabilities in kernel mode.
Solution Approach 2:
A user-mode companion process acts as an intermediary between the kernel-mode driver and sensitive operations. The companion handles cryptographic operations, biometric authentication, and other sensitive tasks, serving as a protective buffer that prevents direct exposure of critical system resources to potentially malicious driver code.
2Productivity
If the driver executes sensitive operations in kernel mode, then performance is improved through direct hardware access, but security is reduced due to privileged access
Solution Approach 1:
Operations are segmented by sensitivity: high-performance device control remains in kernel mode while sensitive cryptographic and authentication operations are moved to user-mode companion processes. This allows performance-critical paths to maintain direct hardware access while security-sensitive operations gain protective isolation.
3Reliability
If the driver is executed in a single domain, then the design is simple and maintenance is easier, but the system lacks isolation for sensitive operations
Solution Approach 1:
The user-mode companion serves as an intermediary layer that adds security functionality without fundamentally redesigning the driver architecture. The companion process model is a well-established Windows mechanism, allowing sensitive operations to be isolated using existing OS features rather than requiring new architectural paradigms.
Solution Approach 2:
The user-mode companion process performs multiple functions: handling cryptographic operations, biometric authentication, and providing a security boundary. By consolidating these sensitive operations in a single user-mode process, the solution adds security without proportionally increasing overall system complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Described herein is a system for driver execution. A driver is loaded in in a first domain with the driver controlling an associated device. In response to a request from the driver, the driver companion is loaded in a second domain different than the first domain, the second domain comprising a secure environment. The driver companion communicates with the associated device. Communications between the driver and the driver companion are managed (e.g., by an operating system framework). In response to a request from the driver, the driver companion is unloaded.