Hypervisor Memory Page Protection for Guest OS Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
User-mode processes in operating systems are vulnerable to malware attacks, particularly when using copy-on-write protection, as existing security features may not effectively monitor and protect physical memory pages marked as shared, allowing potential modifications that could compromise security.
Innovation Solution
A protection module that modifies shared memory pages by copying their contents and redirecting references to new private pages, utilizing a hypervisor to monitor and alert on access, ensuring that any modifications occur on private pages rather than shared ones, thereby preventing unauthorized changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If copy-on-write protection is used for shared memory pages, then memory efficiency is improved, but security against malware attacks deteriorates
Solution Approach 1:
The patent segments the memory protection mechanism into two distinct layers: the operating system level copy-on-write protection for shared memory pages, and the hypervisor level protection for private memory pages. This segmentation allows each layer to handle different security requirements, with the hypervisor providing enhanced monitoring for critical private pages that OS-level protection cannot secure due to API vulnerabilities.
Solution Approach 2:
The patent introduces the hypervisor as an intermediary layer between the user-mode process and the physical memory pages. The hypervisor intercepts and monitors memory access requests, placing alerts on private pages to detect malware modifications before they can compromise the shared memory or process execution, thus bridging the security gap left by OS-level protection mechanisms.
2Reliability
If hypervisor monitoring is implemented for private pages, then security is improved, but system complexity increases
Solution Approach 1:
The patent applies preliminary action by having the protection module proactively identify and redirect references to private memory pages before malware can execute modification attacks. The hypervisor places alerts on these pages in advance, creating a preventive security barrier that detects and blocks malicious modifications before they occur, rather than responding after compromise.
3Ease of operation
If OS-level protection APIs are used, then ease of operation is maintained, but protection effectiveness deteriorates due to API vulnerabilities
Solution Approach 1:
The patent extracts the critical security monitoring function from the vulnerable OS-level APIs and relocates it to the hypervisor layer. By taking out the protection mechanism that depends on potentially compromised OS APIs and implementing it at the hypervisor level, the system eliminates reliance on vulnerable interfaces while maintaining automated protection through the hypervisor's inherent monitoring capabilities.
Data Source
AI summary
A method is provided for a protection module or a process to use a hypervisor to protect memory pages of a guest operating system on the hypervisor. The method includes modifying a shared memory page in a context of the process, which causes the guest operating system to allocate a private memory page to the process, copy data from the shared memory page to the private memory page, and modify the private memory page. The method further includes causing the hypervisor to protect the private memory page by monitoring the private memory page and generating an alert when the private memory page is accessed.