Hypervisor Security via SMM Watchdog Code Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Hypervisor programs are vulnerable to malware attacks, particularly targeting run-time periodic checks, which are essential for ensuring the integrity and security of the system, and existing security measures are not adequately hardened against such threats.
Innovation Solution
The implementation of a method that forms an initial digest of a region of read-write memory containing instruction codes for hardened applications or hypervisor code, enrolls it into a protected region, and periodically recalculates digests using SMM-based watchdog code to ensure operational security and tamper resistance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If run-time periodic checks are implemented to ensure code integrity, then security is improved, but the system becomes more vulnerable to malware attacks targeting these checks
Solution Approach 1:
The system divides code integrity protection into two separate segments: (1) SMM-based watchdog code that operates in a protected real mode environment to perform periodic integrity checks, and (2) hypervisor code that runs in protected mode. This segmentation isolates the critical check-making functionality in SMM, which is harder for malware to compromise, while allowing the hypervisor to focus on virtualization tasks.
Solution Approach 2:
The SMM-based watchdog code acts as an intermediary between the hardware and the hypervisor for performing integrity checks. Instead of the hypervisor directly implementing periodic checks (which creates attack surfaces), the SMM watchdog serves as a trusted mediator that validates hypervisor code integrity independently, using its privileged access to SMM memory and CPU real mode capabilities.
2Reliability
If hypervisor code is made complex to provide comprehensive security checks, then security coverage is improved, but the code size increases making it more vulnerable to attacks
Solution Approach 1:
The patent extracts the critical code integrity checking functionality from the hypervisor code and places it in the SMM-based watchdog code. This separation allows the hypervisor to remain relatively simple and focused on virtualization, while the SMM watchdog handles the security-critical periodic checks. The SMM code is enrolled in a protected region of SMM memory, making it difficult for malware to modify.
Solution Approach 2:
The system performs preliminary enrollment of SMM-based watchdog code and hypervisor code into protected regions before runtime operation. This preliminary action establishes a baseline for code integrity that can be verified during periodic checks, preventing the need for complex runtime analysis and reducing the hypervisor's security-related code size.
3Reliability
If SMM-based watchdog code is used for periodic integrity checks, then tamper resistance is improved, but system complexity increases
Solution Approach 1:
The patent changes the operational parameters of the CPU by utilizing different execution modes (real mode for SMM watchdog, protected mode for hypervisor). This parameter change allows the same physical CPU to support two distinct operational environments with different security characteristics, enabling tamper-resistant checks without adding physical hardware complexity.
Data Source
AI summary
Methods, systems, apparatuses and program products are disclosed for protecting computers and similar equipment from undesirable occurrences, especially attacks by malware. Invariant information, such as pure code and some data tables may be enrolled for later revalidation by code operating outside the normal context. For example, a periodic interrupt may invoked a system management mode interrupt service routine to discover whether code regions accessible to Protected Mode programs have become corrupted or otherwise changed, such as by tampering from untrusted or untrustworthy programs that have easy access only to protected mode operation.