Hypervisor System Call Interception for Kernel Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing operating systems that prohibit kernel patching to prevent malicious activity also hinder legitimate security software, necessitating an alternative method to enhance security without compromising system integrity.
Innovation Solution
A system and method utilizing a hypervisor to intercept system calls and analyze processes for malicious activity, allowing security modules to determine and address threats without modifying the kernel, thereby enabling enhanced security without kernel patching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If kernel patching is allowed to enable security software monitoring, then security monitoring capability is improved, but system integrity is compromised due to potential malicious modifications
Solution Approach 1:
The patent introduces a hypervisor as an intermediary layer between the kernel and security software. The hypervisor intercepts system calls and provides monitoring capabilities without requiring kernel patching. This mediator approach allows security functionality while preserving kernel integrity, as the hypervisor operates at a higher abstraction level and can observe kernel behavior without modifying it.
2Strength
If operating system prohibits kernel patching to prevent malicious activity, then kernel protection is improved, but legitimate security software functionality is hindered
Solution Approach 1:
The patent moves security monitoring from the kernel space to the hypervisor space, effectively changing the dimensional layer at which security operations occur. By operating in the hypervisor layer above the kernel, security software can monitor and control system calls without being constrained by kernel protection mechanisms, thus enabling legitimate security functionality while maintaining kernel protection.
3Reliability
If system calls are intercepted by hypervisor for security analysis, then security threat detection is improved, but system performance is reduced due to additional processing overhead
Solution Approach 1:
The patent implements selective interception of system calls by the hypervisor rather than intercepting all system calls uniformly. The security initialization module configures the hypervisor to intercept only specific system calls that are more likely to be associated with malicious activity. This partial action approach maintains security threat detection capability while minimizing the performance overhead associated with intercepting and analyzing every system call.
Data Source
AI summary
A computer includes a virtual machine controlled by a hypervisor. The virtual machine runs a virtualized operating system with running processes. A security initialization module sets the state in the virtual machine to pass execution from the virtual machine to the hypervisor responsive to a process making a system call in the virtualized operating system. Responsive to execution being passed from the virtual machine to the hypervisor, a security module analyzes the process making the system call to determine whether it poses a security threat. If a security threat is found, the security module takes remedial action to address the threat.