Memory Introspection Engine for VM Integrity Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware solutions for hardware virtualization platforms are complex and incur significant computational overhead, necessitating the development of robust and scalable malware protection methods with minimal computing costs.
Innovation Solution
A host system with a processor configured to execute an operating system and a protection priming module, which allocates virtualized physical memory into pages and reserves memory pages for target software objects satisfying malware protection criteria, ensuring exclusive allocation and minimizing shared page usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory access is limited to a specific registered software agent, then malware detection and prevention are facilitated, but an extra layer of complexity is introduced and significant computational costs are incurred
Solution Approach 1:
The memory space is segmented into pages, and the patent applies different access control policies to different pages. Critical pages containing target software objects are reserved and protected, while non-critical pages maintain standard access controls. This segmentation allows selective protection without imposing complexity on the entire system.
Solution Approach 2:
The patent implements localized protection by reserving specific memory pages for target software objects rather than applying uniform protection across all memory. This local quality approach ensures that only critical areas receive enhanced protection, reducing overall system complexity while maintaining security where needed.
2Reliability
If memory access is limited to a specific registered software agent, then malware detection and prevention are facilitated, but significant computational costs are incurred
Solution Approach 1:
The patent applies partial protection by reserving only the necessary memory pages containing target software objects, rather than protecting the entire memory space. This partial action approach reduces computational overhead while maintaining adequate protection for critical components.
Solution Approach 2:
The patent extracts and protects only the essential target software objects by identifying and reserving their memory pages, separating them from the rest of the memory space. This extraction approach minimizes the computational burden by focusing protection efforts only where necessary.
3Reliability
If pages are reserved for target software objects, then integrity protection with page granularity is achieved, but memory allocation flexibility is reduced
Solution Approach 1:
The patent implements dynamic memory management where pages are reserved for target software objects only when needed, and can be released when no longer required. This dynamic approach maintains integrity protection for critical objects while preserving memory allocation flexibility for other purposes.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Described systems and methods allow protecting a computer system from malware, such as viruses and rootkits. In some embodiments, a hypervisor configures a hardware virtualization platform hosting a set of operating systems (OS). A memory introspection engine executing at the processor privilege level of the hypervisor dynamically identifies each OS, and uses an protection priming module to change the way memory is allocated to a target software object by the memory allocation function native to the respective OS. In some embodiments, the change affects only target objects requiring malware protection, and comprises enforcing that memory pages containing data of the target object are reserved exclusively for the respective object. The memory introspection engine then write-protects the respective memory pages.