Hypervisor Memory Page Protection via Token Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current antivirus solutions are ineffective against rootkit technologies that conceal resources from antivirus applications by exploiting operating system vulnerabilities at the kernel level, making it difficult for present-day antivirus applications to detect malicious programs.
Innovation Solution
A system and method using a hypervisor to protect memory pages by detecting and verifying tokens associated with trusted programs, establishing a protected communication channel, and performing checksum verification to ensure data integrity and confidentiality, with the hypervisor generating unique tokens for each operating system and periodically checking for changes to restore the trusted program if necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a hypervisor is used to protect memory pages, then security and isolation are improved, but device complexity increases
Solution Approach 1:
The system segments memory into protected and unprotected pages, with the hypervisor managing only the critical protected pages. This segmentation allows memory protection without requiring the hypervisor to manage all memory operations, reducing complexity while maintaining security for critical data.
Solution Approach 2:
The hypervisor acts as an intermediary layer between the operating system and physical memory, selectively intercepting and verifying access to protected pages through token validation and checksum verification, providing security without requiring complete system restructuring.
2Measurement precision
If token verification and checksum validation are performed, then detection precision is improved, but processing time increases
Solution Approach 1:
The system performs verification actions selectively rather than universally - only protected memory pages subject to token and checksum verification undergo these checks, while other pages are accessed normally. This partial application of verification maintains high detection precision for critical areas without incurring system-wide time penalties.
Solution Approach 2:
Tokens and checksums are pre-computed and stored with protected memory pages during their creation or loading. When access is requested, the hypervisor simply validates these pre-computed values rather than performing complex analysis in real-time, significantly reducing verification time while maintaining detection precision.
3Reliability
If the hypervisor operates at a lower level than the kernel, then security against rootkits is improved, but ease of operation deteriorates
Solution Approach 1:
The hypervisor extracts and isolates the critical security function of protected memory page verification from the kernel level operations. By handling only specific protected pages rather than all system operations, it maintains superior security against rootkits while presenting a simplified interface to the operating system for routine operations.
Data Source
AI summary
A method for protecting memory pages of a computing device using a hypervisor includes detecting, by a hypervisor, a token associated with the trusted program, in response to receiving a hypercall from a trusted program. The token associated with the trusted program is checked against a saved token of the hypervisor to determine trustworthiness of the trusted program. The hypervisor creates a memory page containing a safe hypercall address of the hypervisor. Addresses of the memory page are transmitted from the hypervisor to the trusted program. The hypervisor allows execution of the hypercall by the trusted program accessing the safe hypercall address found at the addresses of the memory page.