Kernel Integrity Measurement via Segmented Inner Kernel and Independent Engine
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing runtime integrity software is exposed to risks in split kernel environments, making it challenging to detect malicious programs effectively.
Innovation Solution
A system comprising an inner kernel operating at a higher privilege level, a measurement engine operating independently of the OS, and a trusted execution environment that compares measurements from the inner kernel and the measurement engine to detect any changes or compromises, with the ability to take remedial actions such as system restart or re-image.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If runtime integrity software executes in the same space as monitored components, then the software can access and monitor system components directly, but the software becomes exposed to the same risks as the components it monitors
Solution Approach 1:
The system divides the kernel into two separate segments: an inner kernel that operates at a higher privilege level and an outer kernel that operates at a lower privilege level. The integrity measurement architecture is segmented into independent components including a measurement engine, a comparator, and a trusted execution environment, each operating in isolated spaces. This segmentation allows the measurement engine to access kernel data structures without exposing the entire integrity verification system to kernel-level risks.
2Reliability
If a dedicated fixed function hardware component is used for runtime integrity measurements, then measurement reliability is improved, but device complexity and processing overhead increase
Solution Approach 1:
The patent introduces an intermediary measurement engine that operates independently of both the inner and outer kernels. This measurement engine acts as a mediator that can read kernel data structures without being part of the kernel itself, using a privileged execution mode to access protected memory regions. The comparator and trusted execution environment further mediate the verification process, comparing measurements against golden values without requiring complex hardware security modules.
3Reliability
If the inner kernel operates at a higher privilege level than the outer kernel, then protection of critical kernel functions is improved, but system complexity increases
Solution Approach 1:
The kernel is segmented into an inner kernel for critical functions and an outer kernel for less critical operations, with distinct privilege levels. This segmentation is implemented through separate initialization routines, distinct memory space allocations, and separate measurement processes. The inner kernel is measured and verified independently, allowing the system to manage complexity through modular design while maintaining strong protection for critical functions.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system comprising an inner kernel of an operating system (OS) running at a higher privilege level than an outer kernel of the OS, the inner kernel to measure a data structure in a memory; a device including a measurement engine to measure the data structure in the memory, wherein the device operates independently of the OS; and a trusted execution environment including an application to compare measurements from the inner kernel and the measurement engine.