Kernel Intrusion Blocking via Privilege Inversion Monitoring

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for monitoring malicious programs lack reliability in detecting kernel-space access and fail to effectively block unauthorized access, as they are limited by the privilege level of the monitoring modules and require external devices or user-configured settings.

Innovation Solution

A monitoring system that loads monitoring software with a higher privilege level than the OS kernel, allowing it to hook and evaluate kernel instructions, detect malicious access, and block unauthorized access by setting a hook condition and correcting it.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If monitoring software is configured at the same privilege level as the OS kernel, then the monitoring module can access kernel resources, but the monitoring reliability is compromised and malicious programs can bypass detection

Engineering Contradiction:

Improvemonitoring reliabilityVSAvoidprivilege level configuration

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent inverts the traditional privilege level arrangement by positioning the monitoring software (hypervisor) at a higher privilege level (ring -1) than the OS kernel (ring 0). This inversion allows the monitoring software to supervise kernel operations without being compromised by kernel-level malicious programs, fundamentally resolving the reliability issue while maintaining manageable system complexity through structured privilege separation.

Inventive Principle:

Principle #13The other way round (Inversion)

2Reliability

If monitoring software hooks kernel instructions to detect malicious access, then unauthorized access can be detected, but system performance deteriorates due to continuous monitoring overhead

Engineering Contradiction:

Improvedetection accuracyVSAvoidsystem performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The monitoring software implements partial monitoring by selectively hooking only specific kernel instructions that are critical for security (e.g., system call interfaces, memory access instructions) rather than monitoring all kernel operations. This approach maintains high detection accuracy for malicious activities while minimizing performance overhead by avoiding unnecessary monitoring of benign operations.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The patent introduces an intermediary layer (the hypervisor/monitoring software) between the user space applications and the kernel. This intermediary intercepts and evaluates kernel instructions indirectly through controlled interfaces, reducing the direct monitoring overhead on the kernel while maintaining detection capability. The intermediary acts as a buffer that filters and evaluates only relevant operations.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Reliability

If the monitoring software is loaded after the OS kernel, then the kernel can be initialized first, but the monitoring software cannot establish higher privilege level control

Engineering Contradiction:

Improveprivilege level controlVSAvoidsystem initialization process

Core Design Contradiction:

ReliabilityVSEase of manufacture

Solution Approach 1:

The monitoring software (hypervisor) is loaded and initialized before the OS kernel during the boot process. This preliminary action establishes the hypervisor's higher privilege level (ring -1) control before the kernel is initialized, ensuring that the monitoring software can supervise kernel operations from the outset. The boot process is modified to first load the hypervisor, which then configures the privilege level structure before loading the kernel.

Inventive Principle:

Principle #10Preliminary action

4Reliability

If traditional monitoring methods use hash collation to authenticate applications, then legitimate applications can be identified, but the system may stop operation when authentication fails

Engineering Contradiction:

Improveapplication authenticationVSAvoidsystem continuity

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The monitoring software acts as an intermediary that evaluates kernel instructions and application behaviors without relying solely on hash collation authentication. When authentication uncertainty arises, the intermediary layer can intercept operations, log suspicious activities, and make granular decisions about individual operations rather than forcing complete system shutdown. This maintains system continuity while preserving security monitoring.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS10380336B2Information-processing device, information-processing method, and recording medium that block intrusion of malicious program to kernel

Publication Date: 2019.08.13 MURATA KOTARO

AI summary

An information processing device (1) includes: a Syscall instruction monitoring part (313) configured to monitor at least an instruction to pass processing to a kernel (35) of an OS among instructions issued to a CPU (11); and an exclusive loader (201) configured to load a monitoring software (31) functioning as the Syscall instruction monitoring part (313) at region A in a RAM (30), the monitoring software set at ring 0 that is higher than ring (2) set for the kernel (35) of the OS. Even when an access is tried to a resource by executing a malicious program, the access can be detected and intrusion of the malicious program to the kernel can be blocked.