Security Virtual Machine for Unauthorized Code Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security solutions are reactive, operating system dependent, and prone to compromise by malicious code, especially when the operating system components are corrupted, leading to ineffective protection against unauthorized code execution in virtual machines.
Innovation Solution
Implementing a security virtual machine external to the virtual machine to validate the execution of running-pages against a list of authorized pages, using an execution trace code to intercept and validate the contents before execution, and generating security exceptions for unauthorized code, thus providing a centralized, distributed, and efficient security solution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If reactive security solutions are used to detect and remove malicious codes, then the system can identify and respond to threats, but the protection is ineffective because the malicious code has already executed and compromised the system
Solution Approach 1:
The patent implements preliminary action by validating code pages before execution. The security mechanism intercepts pages at the memory management level and verifies their authenticity prior to allowing execution, preventing malicious codes from running rather than detecting them after execution occurs.
Solution Approach 2:
The patent applies preliminary anti-action by establishing access control bits and validation mechanisms in advance that actively prevent malicious code execution before it can occur. The system proactively blocks unauthorized pages from executing rather than reactively responding to threats.
2Reliability
If hardware access control bits are set to prevent code execution, then unauthorized code can be blocked, but the solution is compromised when operating system components are corrupted by malicious codes
Solution Approach 1:
The patent introduces an intermediary validation layer between the hardware access control and the code execution. The security mechanism acts as a mediator that validates code pages before they reach the execution stage, providing an additional layer of protection that is not directly affected by OS component corruption.
Solution Approach 2:
The patent segments the security validation process into separate components: page validation, access control bit setting, and execution authorization. This segmentation ensures that if one component is compromised, the others can still provide protection through independent validation paths.
3Reliability
If distributed security solutions are implemented on each guest virtual machine, then security can be enforced at each guest level, but the solutions require constant updates to support OS updates and become ineffective when viruses bypass segments
Solution Approach 1:
The patent implements universality by creating a security mechanism that operates at the memory management level, which is common across different operating systems and virtual machine configurations. This universal approach allows the same validation logic to function regardless of specific OS updates or virtualization layers without requiring constant reconfiguration.
4Reliability
If security validation is performed on each running page, then unauthorized code can be prevented from executing, but the validation process adds complexity to the memory management and execution control
Solution Approach 1:
The patent performs the complex validation action preliminarily during memory allocation and page loading, rather than during execution. By validating pages upfront and storing validation results in accessible data structures, the system avoids complex validation logic during the critical execution path, reducing runtime complexity while maintaining security.
Data Source
AI summary
Computer implemented methods, system and apparatus for managing execution of a running-page in a virtual machine include associating an execution trace code with the running page by a security virtual machine. The execution trace code generates a notification upon initiation of the execution of the running page by the virtual machine. The notification is received by the security virtual machine running independent of the virtual machine executing the running-page. The running page associated with the execution trace code is validated by the security virtual machine as authorized for execution. An exception is generated if the running-page is not authorized for execution. The generated exception is to prevent the execution of the running page in the virtual machine.