Kernel Address Space Segmentation for Secure System Calls
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing system call mechanisms are vulnerable to attacks from malicious user programs, compromising kernel security, and current solutions for resource isolation, such as Linux namespaces and containerization, either fail to completely isolate critical resources or suffer from performance and compatibility issues.
Innovation Solution
A method where user programs in a user address space request system services via program call instructions in an application interface code library, determining a target authorized address space and system service routine to run the service within that space, maintaining security and efficiency by isolating the impact to only the designated space.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If system calls are used to provide system services from user space to kernel space, then system service functionality is achieved, but security is compromised due to potential malicious attacks on the kernel
Solution Approach 1:
The patent divides the kernel space into multiple isolated address spaces (first address space, second address space, etc.), each providing specific system services. This segmentation ensures that a malicious user program can only affect the specific address space it attacks, not the entire kernel. The first address space handles security-critical services while the second address space handles other system services, creating security zones within the kernel.
Solution Approach 2:
The patent introduces an intermediate layer between user space and kernel space by using address space virtualization. The processor determines which address space should handle a system call based on the service type, acting as an intermediary that directs traffic appropriately. This intermediary mechanism prevents direct unauthorized access to critical kernel areas while maintaining legitimate system service functionality.
2Reliability
If kernel space is isolated from user space to improve security, then security is improved, but system service efficiency and compatibility may deteriorate
Solution Approach 1:
The patent makes address spaces universal by enabling multiple address spaces to provide system services similar to traditional kernel space. Each address space can handle various system service requests, and the processor can dynamically route calls to appropriate address spaces. This multi-functionality ensures that security isolation does not come at the cost of system service efficiency or compatibility.
Solution Approach 2:
The patent performs preliminary setup by creating multiple authorized address spaces with pre-configured system service routines before user programs execute. The processor is pre-programmed with logic to determine which address space should handle each type of system call. This preliminary action eliminates runtime overhead for security checks while maintaining efficient system service delivery.
Data Source
AI summary
Embodiments of the present disclosure relate to a method, system and computer program product for providing system services. In some embodiments, a method is disclosed. According to the method, from a user program in a user address space, a request for a system service is received via a program call instruction of a set of program call instructions in an application interface code library. Based on the program call instruction, a target authorized address space of a plurality of authorized address spaces and a target system service routine for providing the system service in the target authorized address space is determined. A result of running the target system service routine in the target authorized address space is returned to the user program as a response to the request.