Kernel-Mode Integrity Manager Runtime Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security software solutions for computing devices are vulnerable during updates and maintenance, as they may not be active during reboots, allowing security exploits to gain control, and can be subverted by malicious programs, posing risks to system resources and data integrity.
Innovation Solution
An integrity manager associated with kernel-mode components ensures the integrity of these components by enabling rebootless updates, unloading and loading updated versions without rebooting, registering hooks with the operating system, logging events, and performing remediation actions to maintain data integrity and hide the kernel-mode component's existence from other applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security software solutions are updated and maintained by rebooting the computing device, then the security software can be updated with latest protection, but the security software is not active during reboot providing an opportunity for security exploits to gain control
Solution Approach 1:
The patent implements dynamic loading and unloading of kernel-mode components without requiring system reboot. The integrity manager loads updated kernel-mode security components into memory during runtime, allowing the system to maintain continuous operation while updating security protections. This dynamic approach eliminates the vulnerability window during reboot while ensuring latest security updates are applied.
Solution Approach 2:
The integrity manager performs preliminary integrity verification of kernel-mode components before loading them into memory. This preliminary action ensures that only authenticated and uncorrupted security components are loaded, maintaining security protection continuity. The verification process checks digital signatures and component integrity prior to activation, preventing malicious code execution.
2Reliability
If security software solutions are kept running continuously, then protection is always active, but security exploits may subvert the security software by killing or corrupting it
Solution Approach 1:
The integrity manager implements preliminary anti-action by continuously monitoring the integrity of running security software and detecting attempts to subvert or corrupt it. The system uses hooks registered with the operating system to detect unauthorized modifications, file changes, or process termination attempts before they can compromise security. This proactive monitoring prevents exploits from successfully subverting the security software.
Solution Approach 2:
The system implements feedback mechanisms through registered hooks that continuously monitor the state of kernel-mode components and security software. When integrity changes or unauthorized actions are detected, the integrity manager receives feedback and can respond by reloading components, alerting administrators, or isolating compromised elements. This continuous feedback loop maintains security protection while detecting and responding to subversion attempts.
3Reliability
If kernel-mode components are updated without rebooting, then continuous protection is maintained, but the complexity of managing runtime updates increases
Solution Approach 1:
The integrity manager serves as an intermediary between the operating system and kernel-mode security components. It manages the complex runtime update process by coordinating component loading, unloading, and verification operations. The integrity manager abstracts the complexity of runtime updates from the rest of the system, providing a standardized interface for updating security components without rebooting while maintaining system stability and security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are described herein for, without rebooting a computing device, unloading at least a component of a kernel-mode component of the computing device and loading an updated version of the component of the kernel-mode component. The techniques may be performed by an integrity manager associated with the kernel-mode component. The integrity manager may also determine integrity of the kernel-mode component by causing the kernel-mode component to perform an action associated with a known reaction, determining whether the known reaction occurred, and in response, performing a remediation action or notifying a remote security service. Further, the integrity manager may determine whether any computing device lists include representations of components or connections associated with the kernel-mode component. The integrity manager may then remove the representations from the lists or remove the representations from responses to requests for contents of the computing device lists.