Late Load Virtualization Layer Deployment Under Running OS

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing virtualization systems often require reinstalling the operating system on virtual hardware, disrupting existing configurations and lacking real-time security enhancements, as they typically load the virtualization layer before the operating system, rather than underneath it.

Innovation Solution

A late load technique is employed where a ring 0 driver loads the virtualization layer underneath a running operating system by quiescing the guest OS, capturing its state, and then bootstrapping it into a virtual machine, allowing the virtualization layer to control hardware resources without disturbing the existing OS configuration.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If the virtualization layer is loaded before the operating system, then enhanced security is achieved, but the operating system must be reinstalled and existing configurations are disrupted

Engineering Contradiction:

ImprovesecurityVSAvoidoperating system configuration continuity

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

Instead of loading the virtualization layer before the operating system (traditional approach), this patent inverts the sequence by loading the virtualization layer after the operating system is already running. The ring 0 driver is installed within the existing operating system, which then loads the virtualization layer, thereby achieving security enhancement without disrupting existing OS configurations or requiring reinstallation.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The operating system is prepared in advance by installing a ring 0 driver that enables subsequent loading of the virtualization layer. This preliminary installation of the driver allows the system to transition to virtualized execution without interrupting the running OS, preserving configurations while setting up the security infrastructure.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If the virtualization layer is deployed by loading before operating system, then security enhancement is achieved, but system downtime and reboot are required

Engineering Contradiction:

ImprovesecurityVSAvoidsystem downtime

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent inverts the traditional deployment sequence by having the operating system already running before the virtualization layer is loaded. This reversal allows the virtualization layer to be integrated into an active system without requiring shutdown or reboot, thereby eliminating system downtime while achieving security enhancement.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The operating system continues to run and perform useful operations throughout the deployment process. The ring 0 driver enables the virtualization layer to be loaded and activated while the OS remains operational, ensuring continuous useful action without interruption or downtime.

Inventive Principle:

Principle #20Continuity of useful action

3Ease of operation

If the virtualization layer is loaded underneath a running operating system, then existing OS configuration is preserved, but the virtualization layer must be integrated at the highest privilege level

Engineering Contradiction:

Improveoperating system configuration continuityVSAvoidvirtualization layer integration complexity

Core Design Contradiction:

Ease of operationVSDevice complexity

Solution Approach 1:

The ring 0 driver serves as an intermediary between the existing operating system and the virtualization layer. It is installed within the OS at the highest privilege level and facilitates the loading and integration of the virtualization layer, thereby managing the complexity of integration while preserving OS configurations.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The virtualization layer is nested within the existing operating system structure. The ring 0 driver provides the nesting mechanism by enabling the virtualization layer to operate within the OS environment at privilege level 0, creating a nested architecture that preserves outer layer configurations while adding inner layer functionality.

Inventive Principle:

Principle #7Nested doll (Nesting)

Data Source

PatentUS11200080B1Late load technique for deploying a virtualization layer underneath a running operating system

Publication Date: 2021.12.14 MAGENTA SECURITY HOLDINGS LLC

AI summary

A technique deploys a virtualization layer underneath an operating system executing on a node of a network environment to enable the virtualization layer to control the operating system is described. One or more executables (binaries) for the virtualization layer may be included in a kernel module loaded in memory of the node with a first privilege level (e.g., highest privilege level) needed to control the guest operating system. The kernel module may be configured to suspend the guest operating system and one or more hardware resources to a quiescent state. Furthermore, the kernel module is configured to (i) capture and save states of the hardware resource(s) and (ii) bootstrap the virtualization layer to create a virtual machine with an initial state that corresponds to a state of the system prior to deployment of the virtualization layer.