Hypervisor API Security via Version-Specific Header Files
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional hypervisors face challenges in maintaining strict isolation and ensuring compatibility between guest systems and the hypervisor through their application programming interfaces, leading to potential security vulnerabilities and incompatibilities.
Innovation Solution
The method involves generating source code that recognizes version incompatibilities and access rights violations during runtime by assigning specific versions to methods in the utility program library, producing header files with version declarations, and ensuring that only permissible method versions are accessible, preventing errors during translation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the application programming interface permits guest systems to use utility program library methods, then interaction between guest systems and hypervisor is enabled, but security vulnerabilities and access rights violations occur
Solution Approach 1:
The patent applies preliminary action by performing version compatibility checks and access rights validations during the compilation phase before the guest system actually executes API calls. The hypervisor generates version-specific header files that contain declarations of permissible methods, and the compiler verifies compatibility beforehand, preventing security violations before they can occur at runtime.
Solution Approach 2:
The patent introduces an intermediary mechanism in the form of version-specific header files that act as a mediator between the guest system programmer and the hypervisor API. These header files contain declared method signatures and version information, serving as an intermediate layer that enforces compatibility rules and prevents direct unauthorized access to incompatible or forbidden methods.
2Reliability
If version-specific header files are generated during compilation, then compatibility checks are performed early, but additional compilation steps and configuration management are required
Solution Approach 1:
The patent applies parameter changes by varying the header file content based on the detected compiler version and hypervisor version. The code generation process selectively includes or excludes certain API method declarations depending on version compatibility parameters, allowing the same base hypervisor code to work with different compiler versions without manual intervention.
Solution Approach 2:
The patent implements self-service by enabling the hypervisor code generation process to automatically detect the compiler version and generate appropriate version-specific header files without requiring manual configuration by the programmer. The system self-determines the appropriate API subset and generates the corresponding header file declarations autonomously.
Data Source
AI summary
A method for securing an application programming interface of a utility program library, including at least one program construct, of a hypervisor, including a configuration of the hypervisor that assigns at least one permissible call of the program construct to at least one guest system of the hypervisor, and a code generation, supported by the configuration, of a declaration of the program construct adapted to the guest system.