Hypervisor Virtualization Exceptions for Secure VM Hooking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional hooking methods in hardware virtualization configurations are computationally burdensome and vulnerable to malicious entities, degrading user experience and productivity while offering inadequate protection against malware and spyware.
Innovation Solution
A hypervisor is configured to generate exceptions in response to memory access violations within a virtual machine, switching execution from a target function to a security program to determine if the violation indicates a security threat, thereby protecting the host system without triggering a virtual machine exit event.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional hooking methods are used to protect the host system, then security detection capability is improved, but computational burden on the host system increases substantially
Solution Approach 1:
The patent introduces a hypervisor as an intermediary layer between the host system and virtual machines. The hypervisor configures memory access permissions and generates exceptions when violations occur, transferring the security detection workload from the host system to the virtualization layer. This allows security monitoring without substantially burdening the host system's computational resources.
2Reliability
If conventional hooking methods are used to intercept function calls, then security monitoring is improved, but vulnerability to malicious entities increases
Solution Approach 1:
The hypervisor serves as a trusted intermediary that configures memory access permissions and monitors violations. Since the hypervisor operates at a higher privilege level than both the host OS and virtual machines, it provides a more secure monitoring point that is less susceptible to manipulation by malicious entities running within the virtualized environment.
Solution Approach 2:
The patent shifts the security monitoring approach from application-layer hooking to hardware-level memory access control through the hypervisor. By moving security enforcement to the virtualization layer, the system creates a new dimension of protection that operates independently of the potentially compromised application layer.
3Reliability
If memory access permission violations are used to trigger security checks, then security threat detection is improved, but computational overhead is reduced
Solution Approach 1:
The system configures memory access permissions such that security-relevant operations automatically trigger exceptions when violated. The hardware automatically generates exception events when unauthorized memory access occurs, eliminating the need for continuous software-based monitoring and reducing computational overhead while maintaining detection capability.
Data Source
AI summary
Described systems and methods enable a host system to efficiently perform computer security activities, when operating in a hardware virtualization configuration. A hypervisor exposes a virtual machine on the host system. In some embodiments, the hypervisor further configures a processor of the host system to generate a virtualization exception in response to detecting a memory access violation, and to deliver such exceptions to a computer security program operating within the virtual machine. The hypervisor may further set access permissions to a section of memory containing a part of a function targeted for hooking, so that an attempt to execute the respective target function triggers a virtualization exception. Some embodiments thus achieve hooking of the target function without resorting to conventional methods, such as patching, inline hooking, and MSR hooking.