Security Unit for Virtualized Programs with Hypervisor Memory Integration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualized computer programs operating on servers accessible over the public Internet face vulnerabilities due to unauthorized or malicious code attacks, and existing security measures like SecVisor lack mechanisms to interwork with memory page permissions managed by hypervisors, making it difficult to enforce secure memory access policies.
Innovation Solution
A computer-implemented method that involves receiving and modifying computer program data, executing it in a monitored environment, analyzing output for variances, and performing responsive actions such as adjusting security protections based on reputation data and policy, using a security unit with integrated security logic that maintains independent memory page permissions to enforce secure access policies, even in virtualized environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual security review and modification of computer programs is performed, then security protection quality is improved, but the time and resources required increase significantly
Solution Approach 1:
The system performs automated security reviews and modifications of computer programs without requiring manual human evaluation. The security unit automatically analyzes program code, identifies security vulnerabilities, and applies appropriate security modifications, enabling the system to secure itself without external human intervention for each program review.
Solution Approach 2:
The patent replaces manual mechanical review processes with automated computational analysis. Instead of human experts manually examining and modifying program code, the system uses automated security analysis tools and algorithms to detect vulnerabilities and apply security fixes, substituting human cognitive labor with machine-based automated processes.
2Reliability
If SecVisor is used to set memory page permissions, then security against unauthorized code execution is improved, but compatibility with hypervisor memory management is lost
Solution Approach 1:
The patent merges the security functionality of SecVisor with the hypervisor's existing memory management infrastructure. Instead of operating as a separate layer that conflicts with hypervisor control, the system integrates security checks within the hypervisor's memory management unit (MMU), allowing both security enforcement and hypervisor compatibility to coexist through unified memory access control.
Solution Approach 2:
The hypervisor's memory management unit is enhanced to perform both traditional memory management functions and security enforcement functions. The MMU is made universal by enabling it to handle both the hypervisor's memory allocation and protection tasks and the additional security requirements for preventing unauthorized code execution, eliminating the need for separate security infrastructure.
3Adaptability or versatility
If Xen p2m memory page framework is used, then memory management flexibility is improved, but the ability to enforce additional security permissions is lost
Solution Approach 1:
The patent implements nested security checks where the security unit operates within the existing Xen p2m memory page framework. The security enforcement mechanism is nested inside the hypervisor's memory management structure, allowing the system to maintain the flexible memory page types provided by Xen p2m while adding an additional layer of security permission enforcement that operates on top of the existing framework.
Data Source
AI summary
In an embodiment, a data processing method comprises receiving a first instance of computer program data at a security unit having one or more processors; executing the first instance of the computer program data in a monitored environment; observing and recording identification information for each of a plurality of functions called by the first instance of the computer program data; sending the identification information to one or more security enforcement endpoints over a computer network; and generating one or more instructions describing security protections to implement for function calls not included in the identification information in a second instance of the computer program data, and sending the instructions to one or more security enforcement endpoints over a computer network.