Secure World Virtual Processor Kernel Integrity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security systems for computer platforms, including mobile and embedded systems, fail to effectively monitor and protect the OS kernel from unauthorized modifications, which can lead to system compromise and data breaches.
Innovation Solution
Implementing a method that involves instantiating a normal world and a secure world virtual processor to intercept and verify operations associated with kernel modules, using an integrity verification agent to detect and prevent unauthorized changes, ensuring memory protection and system integrity through active monitoring and secure execution environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security systems are used, then system operation is simple, but the OS kernel cannot be effectively monitored and protected from unauthorized modifications
Solution Approach 1:
The system is divided into two distinct virtual processors: a normal world virtual processor for executing standard operations and a secure world virtual processor for monitoring and security-critical operations. This segmentation allows the kernel to be protected without completely redesigning the entire system, as only specific security functions are isolated in the secure world.
Solution Approach 2:
An integrity verification agent is introduced as an intermediary component that runs in the secure world virtual processor. This agent intercepts and verifies operations attempted by the normal world virtual processor, acting as a mediator between the untrusted normal world and the protected kernel resources.
2Reliability
If active monitoring of kernel operations is implemented, then unauthorized modifications can be detected, but system performance and operation speed decrease
Solution Approach 1:
The secure world virtual processor monitors only specific critical operations associated with kernel modules rather than all system operations. This partial monitoring approach provides sufficient integrity verification while minimizing the performance overhead that would result from comprehensive monitoring of every system call and operation.
3Object-affected harmful factors
If memory protection mechanisms are added, then security against breaches is improved, but device complexity increases
Solution Approach 1:
The security features including integrity verification, operation interception, and memory protection are merged into a unified secure world virtual processor environment. This consolidation provides comprehensive security protection while avoiding the complexity that would arise from implementing separate protection mechanisms throughout the system.
Data Source
AI summary
Disclosed herein are techniques for verifying the integrity of an electronic device. A normal world virtual processor and a secure world virtual processor are instantiated. An integrity verification agent is executed by the secure world virtual processor. A kernel operation attempted by the normal world virtual processor is intercepted by the secure world virtual processor.