Privileged Domain Security Layer for Virtualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current virtualization technologies, such as hypervisors like Xen and HyperV, fail to provide adequate protection for privileged domains, making them vulnerable to security threats like unauthorized binary and kernel module execution, and hypercall attacks, which can compromise the security of all guest OS instances.
Innovation Solution
A security layer is inserted in the Domain 0 kernel to intercept and authorize kernel modules and binaries, compute checksums for verification, and randomize hypercalls to ensure only authorized elements can execute, thereby preventing unauthorized access and attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If virtualization technologies are used to run multiple operating systems on a host computer, then system resource utilization and productivity are improved, but security vulnerabilities increase due to inadequate protection of privileged domains
Solution Approach 1:
The patent segments the virtualization system into distinct security zones by implementing a security layer within the privileged domain kernel that separates authorized from unauthorized operations. This segmentation allows the system to maintain high productivity through virtualization while protecting security-critical areas through isolated verification mechanisms.
Solution Approach 2:
The patent introduces an intermediary security layer in the privileged domain kernel that acts as a mediator between virtual machine operations and the underlying hypervisor. This intermediary intercepts and verifies hypercalls, binaries, and kernel modules, allowing productive virtualization operations to proceed while blocking security threats before they reach critical system components.
2Reliability
If security checks are implemented in the privileged domain to prevent unauthorized execution, then security is improved, but system performance and operation speed deteriorate due to additional verification overhead
Solution Approach 1:
The patent implements preliminary action by pre-computing and storing checksums of authorized binaries and kernel modules in the security layer before execution occurs. When these elements are loaded, the system performs rapid checksum comparison against stored values, enabling security verification to proceed in constant time rather than requiring full analysis during execution.
Solution Approach 2:
The patent changes the verification parameter from complex runtime analysis to simple checksum comparison. By transforming the security check into a parameter-based verification (comparing computed checksums against stored reference values), the system achieves high-speed security verification that minimizes impact on overall system operation speed.
3Measurement precision
If checksum verification is performed for every binary and kernel module, then authorization accuracy is improved, but processing time and computational overhead increase
Solution Approach 1:
The patent applies preliminary action by pre-computing checksums for all authorized binaries and kernel modules during system initialization or secure boot processes. These reference checksums are stored in protected memory within the security layer, enabling rapid verification through simple comparison rather than repeated computation during operation.
Solution Approach 2:
The patent uses copying by creating and storing reference copies of authorized binary checksums in the security layer's memory. Instead of re-verification, the system copies the verification task into a simple lookup operation comparing runtime checksums against stored reference copies, dramatically reducing processing time while maintaining verification accuracy.
4Reliability
If the privileged domain is protected as a special entity with security layer insertion, then security against hypercall attacks is improved, but device complexity increases due to additional security mechanisms
Solution Approach 1:
The patent implements universality by designing the security layer to perform multiple security functions within a single integrated structure. The same security layer mechanisms verify hypercalls, validate binaries, check kernel modules, and enforce authorization policies uniformly across all privileged domain operations, reducing overall system complexity compared to separate security mechanisms for each function.
Solution Approach 2:
The security layer implements self-service by autonomously verifying the integrity and authorization of all code execution requests without requiring external security management. The security layer independently computes checksums, compares them against stored references, and enforces authorization decisions, eliminating the need for complex external security management infrastructure.
Data Source
AI summary
A method in one example implementation includes intercepting a request associated with an execution of an object (e.g., a kernel module or a binary) in a computer configured to operate in a virtual machine environment. The request is associated with a privileged domain of the computer that operates logically below one or more operating systems. The method also includes verifying an authorization of the object by computing a checksum for the object and comparing the checksum to a plurality of stored checksums in a memory element. The execution of the object is denied if it is not authorized. In other embodiments, the method can include evaluating a plurality of entries within the memory element of the computer, wherein the entries include authorized binaries and kernel modules. In other embodiments, the method can include intercepting an attempt from a remote computer to execute code from a previously authorized binary.