Kernel Mediator for Secure User Space Hardware Event Handling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing memory virtualization systems face security vulnerabilities when exposing hardware events to user space processing threads, as this can undermine address randomization and masking techniques, potentially allowing attackers to compromise processing threads.
Innovation Solution
The system allows a user space processing thread to listen to and handle hardware events, such as page faults, without exposing virtual addresses, by translating them into offsets relative to a storage object, enabling secure detection and handling of memory alterations across processing threads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If hardware events are exposed to user space processing threads, then functionality and memory tracking capability are improved, but security is worsened due to address randomization and masking techniques being undermined
Solution Approach 1:
The patent introduces a kernel component as an intermediary that receives hardware events containing virtual addresses, translates them to physical addresses, and forwards only the physical addresses to user space. This mediator approach allows user space to access memory event information while preventing direct exposure of virtual address space, thus maintaining security enhancements like address randomization while enabling memory tracking functionality.
2Reliability
If virtual addresses are translated to physical addresses in the kernel, then security is improved by hiding address space layout, but information loss occurs as virtual address information is not exposed to user space
Solution Approach 1:
The patent extracts only the necessary physical address information from the hardware event and removes the virtual address component before passing it to user space. This extraction approach allows the system to maintain security by hiding the virtual address space layout while still providing user space with the essential physical address information needed for memory tracking and handling operations.
Data Source
AI summary
Systems and methods that enable user space processing threads to handle hardware events (e.g., page faults) for another processing thread in a security-enhanced manner. An example method may comprise: associating, by a processing device executing a kernel, a first processing thread with a storage unit of a second processing thread; detecting, by a processing device, a hardware event corresponding to an address of the storage unit; determining a storage object comprising data of the storage unit; translating the address of the storage unit to an offset of the storage object; and transmitting, by the kernel, a notification of the hardware event to the first processing thread, wherein the notification comprises the offset.