Injecting Secret Data into Executable Code via Integrity Module
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures for software applications are vulnerable to unauthorized access, especially when a confidential passkey is compromised, and frequent changes to confidential data are not always feasible or cost-effective.
Innovation Solution
A method is introduced to securely inject secret data into a computer system operating at multiple privilege levels, using a guest integrity module within virtualization software to embed and protect security keys within executable code, ensuring confidentiality even if the guest operating system is compromised.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If confidential data is changed frequently to limit exposure, then security vulnerability is reduced, but implementation flexibility is lost and costs increase
Solution Approach 1:
The patent extracts the confidential passkey from the guest operating system environment and places it in the host operating system environment. The passkey is embedded directly into the virtual machine monitor (VMM) code, separating it from the guest OS where it would be vulnerable to compromise. This extraction allows the system to maintain security without requiring frequent changes to the passkey itself.
Solution Approach 2:
The virtual machine monitor (VMM) acts as an intermediary between the guest operating system and the confidential passkey. Instead of the guest OS directly accessing or storing the passkey, the VMM securely holds and manages the passkey, providing authentication services to guest OSes without exposing the passkey to them. This intermediary approach eliminates the need for frequent passkey changes while maintaining security.
2Ease of operation
If confidential data is stored in the guest operating system, then ease of access is improved, but security is compromised if the OS is breached
Solution Approach 1:
The passkey is extracted from the guest operating system and stored in the host operating system's virtual machine monitor. This physical and logical separation ensures that even if the guest OS is compromised, the passkey remains secure in the host environment. The VMM provides controlled access to the passkey for authentication purposes without exposing it to the guest OS.
Solution Approach 2:
The patent moves the passkey storage from the guest OS dimension to the host OS dimension, creating a hierarchical security architecture. The passkey exists in a higher privilege level (host OS/VMM) that is inaccessible to the guest OS, providing security through dimensional separation rather than within the same operational context.
3Reliability
If the passkey is embedded in executable code, then confidentiality is maintained against OS compromise, but code complexity increases
Solution Approach 1:
The passkey is merged directly into the virtual machine monitor executable code as a literal constant or embedded data section. This combination ensures the passkey cannot be separately extracted or accessed by the guest OS, maintaining confidentiality. The complexity is confined to the VMM code only, not propagated to guest OSes or applications.
Solution Approach 2:
The embedded passkey creates a local quality difference within the VMM code, where specific sections contain confidential data with different access properties than the rest of the code. The passkey portion is marked as read-only or execute-only memory, creating localized security characteristics that protect the confidential data without affecting the overall system architecture.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
In a computer system operable at more than one privilege level, an application is securely customized to use secret data without disclosing the secret data to a managing operating system. In operation, an integrity module executes at a higher privilege level than both the managing operating system and the application. After the managing operating system loads the application executable code, the integrity module injects the secret data directly into the instruction stream of the application executable code and then sets the memory location of the secret data as executable-only. As the application executes at the assigned privilege level, the instruction in the application directly accesses the secret data without performing any indirect memory access, thereby protecting the secret data from malicious attempts to read the secret data at a privilege level lower than the integrity module.