Kernel Integrity Monitoring via Jump Table and BMC
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing runtime integrity monitoring solutions are vulnerable to malicious code injection attacks and struggle to differentiate between legitimate and illegitimate code updates in self-modifying kernels, particularly due to resource-intensive Virtual Machine Introspection (VMI) methods and challenges in protecting hypervisors.
Innovation Solution
A lightweight approach using a Baseboard Management Controller (BMC) or similar device outside the host domain to continuously monitor critical kernel code regions and data structures, employing cryptographic hashing and jump table representations to verify integrity of runtime code updates, and taking remedial actions such as shutting down the system or sending alerts upon tampering detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If Virtual Machine Introspection (VMI) methods are used to monitor kernel integrity, then measurement precision is improved, but device complexity and resource overhead increase
Solution Approach 1:
The patent extracts the integrity monitoring function from the hypervisor/VMI layer and relocates it to a separate measurement device. This device independently measures kernel code regions and communicates measurements to a remote server, eliminating the need for complex VMI implementations while maintaining detection precision.
Solution Approach 2:
The patent introduces a measurement device as an intermediary between the kernel and the monitoring system. This device acts as a simplified mediator that performs measurements without requiring the complex hypervisor infrastructure, thereby reducing device complexity while preserving measurement capabilities.
2Ease of operation
If runtime integrity software executes in the same space as monitored components, then ease of operation is improved, but reliability deteriorates due to exposure to malicious programs
Solution Approach 1:
The patent extracts the integrity software from the host system space and implements it as a separate measurement device. This physical or logical separation removes the software from the attack surface of malicious programs while maintaining operational simplicity through automated measurement and remote verification.
Solution Approach 2:
The patent segments the integrity monitoring system into distinct components: a measurement device that collects data, a kernel under monitoring, and a remote server that verifies integrity. This segmentation isolates the critical integrity verification logic from potential attacks while preserving ease of operation through modular deployment.
3Measurement precision
If cryptographic hashing is applied to all kernel code regions, then measurement precision is improved, but use of energy increases
Solution Approach 1:
The patent applies cryptographic hashing selectively to specific code regions identified in the jump table rather than uniformly to all kernel code. This localized approach maintains precise detection of legitimate updates in critical regions while reducing overall energy consumption by excluding non-critical areas from intensive hashing operations.
Solution Approach 2:
The patent implements partial hashing by focusing computational resources on measuring only the specific code regions that contain jump table entries. This partial action approach provides sufficient measurement precision for security-critical areas while avoiding the excessive energy consumption of hashing entire kernel images.
Data Source
AI summary
Examples disclosed herein relate to integrity monitoring of a computing system using a kernel that can update its own code. Trust of state information is verified. Kernel code and module code are loaded into memory that is accessible to a device separate from a processor that loads the kernel code and module code. A measurement module is verified and loaded into memory. The state information can correspond to multiple symbols. The measurement module can measure the state information corresponding to each of the respective symbols to generate a set of initial measurements. The set of initial measurements can be provided to a device for integrity monitoring. The device is to compare a current measurement with an initial measurement to determine if a potential violation occurred. The device is to use a representation of a jump table to determine whether the potential violation is a violation.