Hypervisor Kernel Object Protection via Guest Monitoring Mode
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security mechanisms for operating system kernels protect kernel code but leave kernel objects vulnerable to malicious modifications by malicious code, such as altering access rights or function pointers.
Innovation Solution
A guest monitoring mode module at the hypervisor pre-allocates a memory space for OS kernel objects, monitors for modification attempts, and takes remedial action if detected as malicious, using invisible breakpoints and write traces to intercept and verify modification attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security mechanisms such as PatchGuard, Driver Signing, and Device Guard are enabled to protect OS kernel code, then kernel code protection is improved, but kernel objects remain vulnerable to malicious modifications
Solution Approach 1:
The patent segments the protection mechanism into two distinct layers: (1) kernel code protection through existing mechanisms like PatchGuard and Driver Signing, and (2) kernel object protection through a new hypervisor-based monitoring system. This segmentation allows each layer to address specific vulnerabilities independently, with the hypervisor monitoring mode specifically targeting kernel object modifications while the signed kernel driver handles code integrity.
Solution Approach 2:
The patent introduces a signed kernel driver as an intermediary component that bridges the hypervisor and kernel objects. The signed kernel driver receives notifications from the hypervisor about modification attempts and executes remedial actions, acting as a mediator that translates hypervisor monitoring data into concrete protection responses without compromising system performance.
2Reliability
If a hypervisor-based monitoring system is implemented to protect kernel objects, then protection capability is improved, but system complexity increases
Solution Approach 1:
The signed kernel driver performs multiple functions: it receives notifications from the hypervisor, identifies modification attempts, executes remedial actions, and manages the protected object list. This multi-functionality reduces the need for separate specialized components, thereby limiting the increase in system complexity while maintaining comprehensive protection capabilities.
Solution Approach 2:
The system implements self-service through automatic remedial actions. When a malicious modification attempt is detected, the signed kernel driver automatically executes pre-defined remedial actions such as terminating malicious processes or restoring kernel objects, without requiring manual intervention. This automation reduces operational complexity while enhancing protection effectiveness.
3Measurement precision
If write traces and invisible breakpoints are used to monitor modification attempts, then detection precision is improved, but processing overhead increases
Solution Approach 1:
The system performs preliminary actions by pre-allocating memory spaces for kernel objects and pre-defining remedial actions before malicious attempts occur. The signed kernel driver maintains a pre-configured list of protected objects and their corresponding remedial actions, enabling rapid response without extensive real-time analysis, thereby reducing processing overhead while maintaining high detection precision.
Solution Approach 2:
The hypervisor monitors only specific kernel objects that are registered with the signed kernel driver, rather than monitoring all memory operations system-wide. This partial monitoring approach focuses computational resources on critical kernel objects, achieving high detection precision for最重要的 targets while minimizing overall processing overhead.
Data Source
AI summary
Example methods are provided to use a guest monitoring mode (GMM) module in a hypervisor to monitor for attempts to maliciously modify operating system (OS) kernel objects in a virtualized computing environment. A created OS kernel object is migrated to a memory space where the GMM module can detect an attempt to modify the OS kernel object. The GMM module uses reference information to determine whether the modification is authorized by trusted OS kernel code or is being attempted by malicious code.