Kernel Memory Segmentation for Microkernel Malware Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Microkernels are vulnerable to kernel-mode malware like rootkits due to full access privileges in kernel mode, even though they provide a smaller attack surface compared to monolithic kernels, as existing designs do not adequately defend against such threats.
Innovation Solution
Implementing a memory management unit (MMU) to map and unmap memory areas during system initialization, restricting access permissions and unmapping unnecessary memory sections after initialization to reduce vulnerability during runtime, thereby preventing kernel-mode attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If full access privileges are provided to kernel mode for system initialization and operation, then the kernel can execute all necessary code and access all memory areas, but malicious software gains complete control over system memory once it infiltrates the kernel
Solution Approach 1:
The patent segments the kernel code into multiple sections with different access permissions. Specifically, it divides kernel code into initialization code (accessible during boot) and runtime code (accessible during operation), applying different memory protection attributes to each segment. This allows the kernel to function properly while limiting the damage potential of any single compromised section.
Solution Approach 2:
The patent implements preliminary security measures by setting up memory protection attributes during system initialization before any user-space code executes. The MMU is configured with page table entries that establish read-only and no-execute permissions on kernel memory areas before potential attacks can occur, preventing malicious code execution even if infiltration happens.
2Object-affected harmful factors
If a minimal microkernel is used to reduce attack surface, then fewer vulnerabilities exist in the kernel itself, but any malware that gains kernel access still obtains complete control over all system memory
Solution Approach 1:
The patent applies local quality by granting different access permissions to different regions of kernel memory. Instead of uniform full access, specific memory pages are marked with distinct attributes (read-only, no-execute, or restricted access) based on their function. This ensures that even if an attacker compromises part of the kernel, they cannot execute or modify code in protected regions.
Solution Approach 2:
The patent introduces the Memory Management Unit (MMU) as an intermediary between the kernel code and physical memory. The MMU enforces memory protection policies by translating virtual addresses to physical addresses while checking access permissions. This intermediary layer prevents direct unauthorized access to kernel memory areas, blocking malware attempts to gain complete memory control.
3Reliability
If memory protection mechanisms are implemented to restrict kernel access, then security against malware is improved, but system complexity increases due to additional memory management requirements
Solution Approach 1:
The patent implements self-service by having the kernel itself manage its own memory protection attributes without requiring external security software or complex additional management layers. The kernel configures the MMU page tables during initialization to establish protection policies, and these policies are automatically enforced by the hardware. This approach provides strong security while minimizing added complexity.
Data Source
AI summary
A non-transitory computer-readable storage medium storing a set of instructions executable by a processor, the set of instructions, when executed by the processor, causing the processor to perform operations including mapping a memory area storing a segment of code for a kernel of the system during an initialization time of a system. The operations also include executing the segment of code during the initialization time. The operations also include unmapping a portion of the memory area for the kernel after the segment of code has been executed.