Kernel Protection Architecture with Primary VMs for Multi-Guest Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Android's monolithic OS kernel faces security vulnerabilities when running too many drivers or software, and existing hypervisor-based kernel protection systems face management complexity and security concerns, particularly when supporting multiple guest virtual machines.
Innovation Solution
A system is introduced with a command hub running on a processor or implemented by pure hardware, primary virtual machines, and a hypervisor, where the primary VMs manage and configure safety settings for guest VMs, offloading management tasks from the hypervisor, allowing guest VMs to run complex software while maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a hypervisor is used for kernel protection to monitor and filter vulnerabilities, then security is improved, but the hypervisor complexity increases and management ability becomes insufficient when supporting multiple guest VMs
Solution Approach 1:
The system divides the kernel protection function into multiple independent primary VMs, each responsible for specific protection tasks. This segments the monolithic hypervisor's management burden into distributed, specialized units that can operate independently, reducing overall system complexity while maintaining comprehensive security coverage.
Solution Approach 2:
Primary VMs act as intermediary layers between the hypervisor and guest VMs. They handle the complex policy enforcement and security analysis tasks, allowing the hypervisor to focus on basic virtualization functions. This intermediary structure reduces the hypervisor's management complexity while preserving strong kernel protection capabilities.
2Productivity
If a thinner and lighter hypervisor is used for cost and performance considerations, then cost and performance are improved, but the management ability becomes insufficient when the system supports too many guest VMs
Solution Approach 1:
By segmenting management functions across multiple primary VMs, the system enables a lightweight hypervisor to effectively manage many guest VMs. Each primary VM handles a portion of the management workload, distributing the complexity and allowing the hypervisor to remain thin and performant while scaling to support numerous guests.
3Reliability
If the hypervisor integrates all security policies for guest VMs, then security management is centralized, but the cost and convenience in mass production are degraded
Solution Approach 1:
Security policies are segmented and distributed to individual primary VMs rather than being centralized in the hypervisor. This allows different policy sets to be independently configured and deployed, simplifying mass production processes where different device variants can receive appropriate policy configurations without requiring complex centralized management overhead.
Solution Approach 2:
Primary VMs autonomously enforce their assigned security policies on relevant guest VMs without requiring constant hypervisor intervention. This self-service capability simplifies deployment and mass production, as policies are automatically applied by the primary VMs once configured, reducing manual intervention requirements.
Data Source
AI summary
A system for kernel protection includes a processor and a transmission interface. The processor is arranged to execute at least one guest virtual machine (VM), at least one primary VM, and a hypervisor. The at least one guest VM is arranged to send at least one command to a command hub. The at least one primary VM is arranged to manage and configure a safety setting according to the at least one command from the command hub and at least one policy, and manage and configure a safety protection component according to the safety setting. The hypervisor is arranged to manage and configure the safety protection component according to a ground rule and at least one safety setting command from the at least one primary VM. The transmission interface is arranged to bind the at least one primary VM to the hypervisor.