Protection Agent Isolation via Virtual Machine Monitor Privilege Modes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current operating systems are vulnerable to malware that can hide in privileged mode memory, evading detection by antivirus applications and compromising system security, as existing protection systems rely on obscurity and operate within the same protection domain as the operating system, making them susceptible to attacks and unable to initialize if malware gains control before system boot.
Innovation Solution
The implementation of tools that create a protection-agent privilege mode, either by requesting protection from a virtual machine monitor or by virtualizing a physical processor into multiple virtual processors, including a protection-agent virtual processor, to make a portion of operating-system memory unalterable or inaccessible from the operating-system privilege mode, thereby isolating the protection agent and preventing tampering.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If protection systems operate within the same protection domain as the operating system, then they can monitor operating-system resources, but they become vulnerable to malware that gains access to privileged mode
Solution Approach 1:
The system divides the protection domain into separate privilege levels. The protection agent operates in a privileged mode that is separated from the operating system's privilege mode, creating distinct protection domains. This segmentation allows the protection agent to monitor OS resources while being isolated from malware that compromises OS-level privileges.
Solution Approach 2:
The protection agent acts as an intermediary between the hardware and the operating system. By positioning itself at a higher privilege level than the OS, it mediates access to critical resources and can detect malware attempts before they reach the OS level, providing an intermediate layer of defense.
2Adaptability or versatility
If protection systems initialize at the same time as the operating system, then they can be integrated into the system, but they may fail to initialize if malware gains control before system boot
Solution Approach 1:
The protection agent is designed to initialize before the operating system boots. By performing preliminary initialization at a higher privilege level during hardware firmware execution, the protection agent establishes its monitoring capabilities before malware can infect the system, ensuring reliable initialization even in compromised environments.
3Object-affected harmful factors
If protection systems rely on obscurity to hide from malware, then they can evade detection, but they become vulnerable if malware deciphers their identity
Solution Approach 1:
Instead of hiding the protection system from malware through obscurity, the system inverts the approach by making the protection agent more visible and accessible than the operating system itself. The protection agent operates at a higher privilege level with transparent identity, relying on its elevated status rather than concealment to prevent malware interference.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
This document describes tools capable of making a portion of operating-system memory associated with a protection agent unalterable or inaccessible from an operating-system privilege mode. In some embodiments, these tools are capable of creating a protection-agent privilege mode by requesting that a virtual machine monitor protect this portion of operating-system memory. In other embodiments, these tools are capable of creating the protection-agent privilege mode by virtualizing a physical processor into multiple virtual processors, at least one of which is a protection-agent virtual processor designed to run the protection agent. By making this portion of operating-system memory unalterable or inaccessible from the operating-system privilege mode, the protection agent may be less vulnerable to attacks by entities operating within the operating-system privilege mode.