Nested Virtualization Layer for Guest Process Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualization architectures struggle to effectively protect guest processes from sophisticated malware attacks that exploit vulnerabilities in operating system data structures and applications, as conventional security measures like anti-virus software and virtual machines can be infected by altering resource states.
Innovation Solution
A virtualization layer with a micro-hypervisor and hyper-processes that determine when a guest operating system switches processes, identify the guest process, and apply a protection policy by hashing code pages and using nested page tables to override permissions, ensuring protection at the granularity of memory pages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security measures like anti-virus software and virtual machines are used, then basic malware detection is achieved, but sophisticated malware can infect these virtual machines by altering resource states to avoid detection
Solution Approach 1:
The patent implements a nested virtualization architecture where a micro-hypervisor runs inside the guest operating system, creating a nested hierarchy of virtualization layers. This nested structure allows the micro-hypervisor to monitor and control guest process executions from within, preventing malware from infecting the virtual machine by maintaining an inner layer of protection that is isolated from guest-level attacks
Solution Approach 2:
The micro-hypervisor acts as an intermediary layer between the guest operating system and the hardware resources. It intercepts and monitors system calls, process creations, and resource accesses, preventing malware from directly altering critical resource states. The hyper-processes in the host environment serve as additional intermediaries that coordinate security policies and respond to threats
2Reliability
If strict security specifications are enforced on nodes, then system integrity is improved, but execution of necessary software with known vulnerabilities is prevented
Solution Approach 1:
The patent applies security protection at the granular level of individual processes rather than enforcing uniform security policies across the entire system. The micro-hypervisor can identify specific guest processes and apply targeted protection measures, allowing necessary software with known vulnerabilities to execute under controlled conditions while maintaining system integrity through process-level isolation and monitoring
3Difficulty of detecting and measuring
If virtualization layer monitors all guest process activities, then malware detection capability is improved, but system performance and overhead increase
Solution Approach 1:
The micro-hypervisor performs preliminary actions by pre-configuring protection policies and establishing monitoring rules before malware can execute malicious code. It proactively identifies suspicious processes based on predefined criteria and takes preventive measures, reducing the need for continuous exhaustive monitoring of all system activities and thereby maintaining performance while detecting threats
Data Source
AI summary
A technique protects guest processes of a guest operating system kernel using a virtualization layer of a virtualization architecture executing on a node of a network environment. The virtualization layer may include a user mode portion having hyper-processes and a kernel portion having an micro-hypervisor that cooperate to virtualize the guest operating system kernel within a virtual machine and to make hardware resources of the node available for use by the guest operating system kernel, either as pass-through resources, emulated resources, or a combination thereof. Illustratively, the micro-hypervisor may cooperate with the hyper-processes of the virtualization layer to protect the guest processes against attack by one or more exploits that may employ malware. To that end, the guest process protection technique enables the micro-hypervisor and/or hyper-processes of the virtualization layer to determine (i) when the guest operating system switches to a guest process for execution, (ii) an identity of the guest process, and (iii) a protection policy to be associated with the guest process identity.