Kernel Memory Protection Using Page Table Interrupt Flags
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing operating systems lack effective mechanisms to protect kernel memory areas from unauthorized access and tampering, particularly due to the high permission level of kernel code, making them vulnerable to attacks by malicious code.
Innovation Solution
Implement a data protection method that distinguishes between sensitive and insensitive data, using flag bits in page table entries to trigger interrupts for abnormal access, and employs a watchdog to monitor and update lists of sensitive data in real-time, ensuring only authorized access is allowed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If kernel code runs in kernel mode with high permission, then code execution efficiency is improved, but data security deteriorates due to unrestricted access to kernel memory
Solution Approach 1:
The patent segments kernel memory into protected and non-protected areas, and separates code into kernel mode and user mode. By dividing the kernel memory space and access permissions, the system allows efficient kernel mode execution for legitimate operations while restricting access to sensitive data regions, thus resolving the contradiction between execution efficiency and data security.
Solution Approach 2:
The patent introduces an intermediary protection mechanism that sits between kernel mode code and kernel memory. This intermediary layer monitors and controls access to protected memory regions, allowing legitimate kernel operations to proceed efficiently while blocking malicious access attempts, thereby maintaining both execution efficiency and data security.
2Reliability
If general memory protection is implemented, then basic security is improved, but protection against abnormal kernel memory access deteriorates due to unrestricted kernel mode permissions
Solution Approach 1:
The patent applies local quality by providing different protection levels to different regions of kernel memory. Sensitive areas such as interrupt descriptor tables and critical data structures receive enhanced protection through specific protection bits and access controls, while non-sensitive areas maintain standard access permissions. This localized differential protection effectively counters abnormal access while maintaining system functionality.
3Reliability
If direct access to protected data is prohibited, then data security is improved, but system performance deteriorates due to interrupt triggering on every access
Solution Approach 1:
The patent applies partial action by protecting only specific sensitive regions of kernel memory rather than implementing universal protection across all kernel memory. By selectively applying protection to critical areas like interrupt descriptor tables and sensitive data structures while leaving other areas accessible, the system maintains data security for essential components without incurring excessive performance overhead from universal monitoring.
Data Source
AI summary
A data protection method includes determining data that needs to be protected, and prohibiting direct access to the data that needs to be protected; if accessed data is the data that needs to be protected, triggering an interrupt to determine whether the access is abnormal; and restricting the access when the access is abnormal, or allowing the access when the access is normal.