Hypervisor Kernel Rootkit Protection via Soft Whitelist
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current kernel rootkit protection methods in hypervisor environments are inefficient, as they require significant memory and runtime overhead, and are not effective in detecting and preventing kernel rootkits that subvert authentication mechanisms, especially in virtualized environments where traditional solutions are not feasible.
Innovation Solution
A system and method that creates a soft whitelist of guest kernel pages within a hypervisor, using a hash of machine page frame numbers to authenticate and authorize access, marking unauthorized pages as non-executable, and employing a lockdown feature to prevent execution of unauthorized code, thereby providing transparent and agent-less protection against kernel rootkits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional kernel rootkit protection methods are used in hypervisor environments, then security protection is provided, but memory overhead and runtime overhead increase significantly
Solution Approach 1:
The patent extracts the rootkit protection functionality from the guest operating system and implements it in the hypervisor layer through shadow page tables. This separation allows the protection mechanism to operate independently without requiring additional memory structures within the guest OS, thereby reducing memory overhead while maintaining protection effectiveness.
Solution Approach 2:
The shadow page table structure serves multiple functions: it provides memory management for the guest OS, implements kernel code authentication, and prevents rootkit execution. By combining these functions into a single data structure, the patent eliminates the need for separate protection structures, reducing overall memory overhead.
2Reliability
If traditional kernel rootkit protection methods are used in hypervisor environments, then security protection is provided, but runtime overhead increases significantly
Solution Approach 1:
The patent performs kernel code authentication in advance by creating shadow page tables that pre-validate kernel code pages during the boot process. This preliminary authentication ensures that only valid kernel code can be executed, eliminating the need for continuous runtime validation and reducing operational overhead during system execution.
Solution Approach 2:
The shadow page table mechanism allows the CPU to skip detailed authentication checks during runtime by using pre-computed hash values and straightforward page table lookups. This streamlined approach rushes through the validation process efficiently, minimizing runtime overhead while maintaining security.
3Reliability
If soft whitelist with hash of machine page frame numbers is used, then unauthorized code execution is prevented, but detection precision must be maintained
Solution Approach 1:
The patent replaces complex mechanical scanning and analysis mechanisms with a cryptographic hash-based verification system. By computing hash values of kernel code pages and storing them in shadow page tables, the system achieves precise detection of unauthorized code through mathematical verification rather than cumbersome mechanical inspection, maintaining high detection precision with reduced overhead.
Data Source
Figure 1
Figure 2
AI summary
A system and method in one embodiment includes modules for creating a soft whitelist having entries corresponding to each guest kernel page in a guest operating system in a hypervisor environment, generating a page fault when an access attempt is made to a guest kernel page, fixing the page fault to allow access and execution if the guest kernel page corresponds to one of the entries in the soft whitelist, and denying execution if the guest kernel page does not correspond to any of the entries in the soft whitelist. If the page fault is an instruction page fault, and the guest kernel page corresponds to one of the entries in the soft whitelist, the method includes marking the guest kernel page as read-only and executable. The soft whitelist includes a hash of machine page frame numbers corresponding to virtual addresses of each guest kernel page.