Policy-Driven Kernel Extension Loading With Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing loadable kernel extensions in cloud and server systems face security vulnerabilities due to implicit trust, leading to potential compromises in data processing systems, with limited protection against untrusted software and complex access privileges.
Innovation Solution
Implement a policy-driven approach that includes validating kernel extension metadata against an allowlist and blocklist, performing integrity measurements, and ensuring signature verification to control access and loading of extensions, with policy-based restrictions at load-time and run-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If kernel extensions are implicitly trusted to maintain high security standards, then system security is maintained, but the system becomes vulnerable to untrusted software compromising the kernel
Solution Approach 1:
The patent applies preliminary action by performing integrity measurements and policy validations on kernel extensions before they are loaded into the kernel space. The system measures the integrity of extension code and validates metadata against policies in advance, ensuring that only trusted extensions are loaded, thereby preventing security vulnerabilities before they can compromise the kernel
Solution Approach 2:
The patent introduces an intermediary validation mechanism that acts as a mediator between user space and kernel space. This intermediary layer verifies extension integrity and enforces policies, creating a security buffer that prevents direct trust relationships and blocks untrusted software from compromising the kernel
2Reliability
If policy validation and integrity measurements are performed on all kernel extensions, then security is enhanced, but system latency increases
Solution Approach 1:
The patent performs integrity measurements and policy validations in advance during the extension loading process, before the extension is executed. By completing security checks preliminarily, the system ensures that extensions are verified once during loading rather than continuously during execution, reducing overall latency while maintaining security
Solution Approach 2:
The patent applies partial action by performing validation and integrity measurements selectively based on policy requirements. The system validates metadata and measures integrity only when necessary according to the configured policies, avoiding unnecessary validation overhead for trusted extensions while maintaining security for untrusted ones
Data Source
AI summary
A computer-implemented method (CIM), according to one embodiment, includes receiving, at a kernel space of a data processing system, from a user space, a policy, a kernel extension code, and metadata associated with the kernel extension code. The metadata describes at least one type of attachment point in the kernel space, and the policy includes an allowlist and a blocklist of metadata for the attachment points. The method further includes validating the metadata against the policy, and performing an integrity measurement on the kernel extension code. In response to a determination that the metadata is validated against the policy and the integrity measurement is verified, the kernel extension code is loaded in the kernel space.