Hypervisor Kernel Memory Segmentation for Crash Data Collection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Kernel protection mechanisms are not compatible with technologies requiring write and/or execute access, rendering them impractical for use in production environments and preventing the collection of kernel data during crashes.
Innovation Solution
A protected kernel environment is implemented using a hypervisor that allocates guest memory with adjustable access privileges, allowing data collection while maintaining kernel protection by disabling write and execute access to specific memory pages, enabling the activation of a data collection kernel in case of a crash.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If kernel protection mechanisms are implemented to prevent write and execute access to kernel memory, then kernel security and integrity are improved, but compatibility with data collection technologies deteriorates
Solution Approach 1:
The patent divides kernel memory into distinct segments with different access privileges. Specifically, it separates kernel read-only memory (where the kernel image resides and protection is enforced) from kernel executable memory (where data collection technologies can operate). This segmentation allows simultaneous enforcement of kernel protection on read-only segments while permitting write and execute access on executable segments, thereby resolving the contradiction between security and compatibility.
Solution Approach 2:
The patent applies different access privilege qualities to different regions of kernel memory. Rather than uniformly restricting all kernel memory, it locally configures read-only attributes for specific kernel code segments while leaving other segments with full write and execute permissions. This local differentiation enables data collection technologies to function in permitted regions while maintaining protection in critical regions.
2Reliability
If kernel protection mechanisms prevent write and execute access to kernel memory, then kernel integrity is maintained, but the ability to collect kernel data during crashes is lost
Solution Approach 1:
The patent performs preliminary configuration of kernel memory access privileges before the kernel operates. During system initialization, the kernel identifies and marks specific memory regions as executable and writable for data collection purposes, while protecting other regions. This preliminary setup ensures that when a crash occurs, data collection technologies already have the necessary permissions to access and analyze kernel memory without being blocked by protection mechanisms.
Solution Approach 2:
The patent segments kernel memory into protected regions (containing critical kernel code) and accessible regions (designated for data collection). By creating this segmentation, the system maintains kernel integrity in protected segments while enabling crash data collection in accessible segments, thus preventing information loss during crashes without compromising overall kernel integrity.
3Object-affected harmful factors
If write and execute access is disabled to kernel memory pages, then unauthorized access is prevented, but legitimate data collection operations are blocked
Solution Approach 1:
The patent applies local quality by configuring distinct access privileges for different kernel memory pages. Critical kernel code pages are marked as read-only to prevent unauthorized modification and execution, while specific pages designated for data collection operations are marked with full read-write-execute permissions. This localized privilege assignment allows unauthorized access prevention in critical areas while maintaining ease of operation in data collection areas.
Solution Approach 2:
The patent introduces a memory management intermediary (the hypervisor or memory management unit) that mediates access requests to kernel memory. This intermediary enforces protection policies by blocking unauthorized access attempts to read-only pages while simultaneously permitting legitimate data collection operations on executable pages. The intermediary thus reconciles the conflict between security restrictions and operational requirements.
Data Source
AI summary
Methods, systems, and computer program products are included for collecting kernel data in a protected kernel environment. A method includes allocating a first portion of a memory for a first kernel and reserving a second portion of the memory for a second kernel. The second kernel is stored in the second portion of the memory. A hypervisor is provided a memory address corresponding to the second portion of the memory. The hypervisor disables write and execute access privileges corresponding to the second portion of the memory. After a crash occurs corresponding to the first kernel, the second kernel is attempted to be executed. The hypervisor detects the attempted execution of the second kernel. The hypervisor enables execute access privileges corresponding to the second portion of the memory. After the execute access privileges are enabled, the second kernel is executed to collect data corresponding to the first kernel.