Hypervisor Memory Access Interception for Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security exploit protection techniques, such as running guest operating systems in virtual machines, are unable to intercept memory accesses or instruction executions on the host OS, leading to significant overhead and incomplete protection against threats like privilege escalation and credential theft.
Innovation Solution
A security agent configured to initiate as a hypervisor, determining and setting intercepts on specific memory locations by adjusting privilege attributes, allowing monitoring and protection of sensitive information while enabling operations on other memory locations, and temporarily resetting attributes to allow certain operations to prevent system crashes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory access interception is implemented at kernel-mode or user-mode using hooks, then security monitoring capability is improved, but system overhead increases and host OS memory accesses cannot be intercepted
Solution Approach 1:
The patent segments memory interception capability by creating separate virtual machine instances for different monitoring purposes. The host OS runs in one virtual machine while security monitoring occurs in another virtual machine, allowing selective interception of memory accesses without affecting the entire system uniformly.
Solution Approach 2:
The patent implements nested virtualization where a virtual machine monitors memory accesses of the host OS. The hypervisor creates a nested structure where the monitored system (host OS) is itself virtualized, allowing the monitoring VM to intercept memory accesses at the hypervisor level without requiring kernel-mode hooks in the host OS.
2Reliability
If all memory locations are intercepted to protect against security exploits, then security coverage is improved, but system performance deteriorates due to excessive interception overhead
Solution Approach 1:
The patent applies local quality by enabling interception only for specific memory locations that contain sensitive information such as credentials or privileged data. The hypervisor identifies and selectively intercepts accesses to these critical regions while allowing unrestricted access to other memory areas, thereby maintaining security coverage for sensitive data while preserving overall system performance.
3Reliability
If privilege attributes are set to prevent operations on memory locations, then security protection is improved, but system functionality deteriorates due to prevented legitimate operations
Solution Approach 1:
The patent implements dynamic privilege attribute management where access permissions for memory locations are not fixed but change based on the current operational context. The hypervisor dynamically adjusts privilege attributes to allow legitimate operations when authorized while blocking unauthorized access, enabling the system to adapt between security protection and functional requirements in real-time.
Solution Approach 2:
The hypervisor acts as an intermediary between security protection mechanisms and system operations. It mediates memory access requests by evaluating whether they should be permitted, temporarily adjusting privilege attributes to allow legitimate operations while maintaining security boundaries, thus preventing system crashes caused by overly restrictive access controls.
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
A security agent configured to initiate a security agent component as a hypervisor for a computing device is described herein. The security agent is further configured to determine a subset of memory locations in memory of the computing device to be intercepted. The security agent component may then set intercepts for the determined memory locations. Setting such intercepts may include setting privilege attributes for pages which include the determined memory locations so as to prevent specific operations in association with those memory locations. In response to one of those specific operations, the security agent component may return a false indication of success or allow the operation to enable monitoring of the actor associated with the operation. When an operation affects another memory location associated with one of the pages, the security agent component may temporarily reset the privilege attribute for that page to allow the operation.