Separation Kernel Hypervisor for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing hypervisor systems face limitations in detecting and defending against malicious code, as they cannot prevent themselves from being subverted and allow malicious code to spread between guest operating systems, and they struggle to maintain isolation and security, especially when antivirus software or monitoring agents within the guest operating system are corrupted.
Innovation Solution
The implementation of a Separation Kernel Hypervisor that provides secure and isolated mechanisms for monitoring and detecting malicious code by using Guest Operating System Virtual Machine Protection Domains and a Virtualization Assistance Layer, ensuring that detection mechanisms are proximate to but incorruptible by malicious code, and allowing for real-time notification and context switching to prevent malicious execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a traditional hypervisor is used to support multiple guest operating systems, then virtualization functionality is provided, but the hypervisor cannot defend itself against malicious code and allows malicious code to spread between guests
Solution Approach 1:
The system segments the hypervisor functionality into two distinct components: a traditional hypervisor that provides virtualization services, and a separate separation kernel that provides security and isolation. This segmentation allows the security functions to be isolated from the main hypervisor, preventing malicious code from compromising the entire system while maintaining virtualization capabilities.
Solution Approach 2:
The separation kernel acts as an intermediary layer between the hypervisor and guest operating systems. It mediates security-critical operations and provides an additional layer of protection, preventing direct access between guests while allowing controlled communication through the kernel's security policies.
2Measurement precision
If antivirus software or monitoring agents are placed within the guest operating system, then code execution can be monitored, but the monitoring mechanisms can be corrupted by malicious code
Solution Approach 1:
The separation kernel serves as an intermediary monitoring layer that operates outside the guest operating system's control. It provides code execution detection and monitoring capabilities while being protected from corruption by malicious code within guests, as it runs in a privileged, isolated environment.
Solution Approach 2:
The monitoring function is moved from the guest operating system dimension to the host system dimension, where the separation kernel operates at a higher privilege level. This dimensional shift allows monitoring to occur in an environment that is spatially and temporally isolated from guest-based malicious code.
3Ease of operation
If guests are allowed to poll memory and information within monitored guests, then debugging and security monitoring are enabled, but the monitored guest's isolation and security are compromised
Solution Approach 1:
The separation kernel acts as an intermediary that controls and mediates all access between guest operating systems. It enables authorized monitoring and debugging operations while enforcing strict isolation policies, allowing security personnel to monitor guests without compromising the fundamental isolation boundaries between them.
Data Source
AI summary
Systems, methods, computer readable media and articles of manufacture consistent with innovations herein are directed to computer virtualization, computer security and/or memory access. According to some illustrative implementations, innovations herein may utilize and/or involve a separation kernel hypervisor which may include the use of a guest operating system virtual machine protection domain, a virtualization assistance layer, and/or a detection mechanism (which may be proximate in temporal and/or spatial locality to malicious code, but isolated from it), inter alia, for detection and/or notification of, and action by a monitoring guest upon access by a monitored guest to predetermined physical memory locations.