Separation Kernel Hypervisor Isolation for Rootkit-Resistant Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing hypervisors are limited in their ability to detect and prevent malicious code, particularly due to their vulnerability to subversion and inability to protect monitoring agents within guest operating systems, and they lack comprehensive mechanisms to defend against sophisticated and adaptive malware.
Innovation Solution
The use of a Separation Kernel Hypervisor that provides secure, isolated mechanisms to monitor and prevent malicious code by maintaining temporal and spatial locality with guest operating systems, utilizing guest operating system virtual machine protection domains and rootkit defense mechanisms that are immune to corruption and interference.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a hypervisor is used to monitor guest operating systems for malicious code, then monitoring capability is provided, but the hypervisor itself can be subverted by malicious code and monitoring agents can be corrupted
Solution Approach 1:
The system segments the virtualization environment into distinct protection domains: a Separation Kernel Hypervisor in hypervisor context and guest operating systems in guest virtual machine protection domains. This segmentation isolates the monitoring function from the monitored entities, preventing malicious code in guest domains from subverting the hypervisor or corrupting monitoring agents in the separation kernel.
Solution Approach 2:
The Separation Kernel Hypervisor acts as an intermediary between the hardware platform and guest operating systems, providing monitored access and isolation. It mediates all interactions between protection domains, ensuring that monitoring mechanisms remain protected while maintaining necessary communication and resource access.
2Measurement precision
If monitoring mechanisms are placed within the same guest operating system as malicious code, then close monitoring is achieved, but the monitoring agent can be corrupted by the malicious code
Solution Approach 1:
The system divides the virtualization space into separate protection domains: guest operating systems execute in guest virtual machine protection domains while the Separation Kernel Hypervisor executes in hypervisor context. This segmentation allows monitoring mechanisms to maintain close proximity to guest OS resources while being isolated in a protected domain that cannot be corrupted by malicious code.
Solution Approach 2:
The patent introduces a vertical dimension of isolation by implementing protection domains at different hierarchical levels. The Separation Kernel Hypervisor operates at the hypervisor level (higher dimension) while guest OSes operate at the guest virtual machine level (lower dimension), allowing monitoring across domains without direct contamination risk.
3Adaptability or versatility
If traditional hypervisors are used to defend against malicious code, then basic virtualization is provided, but comprehensive defense against sophisticated and adaptive malware is lacking
Solution Approach 1:
The system segments security functions into distinct protection domains within the virtualization architecture. Each guest operating system runs in its own guest virtual machine protection domain, while the Separation Kernel Hypervisor provides centralized security management in hypervisor context, enabling comprehensive defense without requiring complex modifications to each individual component.
Solution Approach 2:
The Separation Kernel Hypervisor provides universal security functions across all guest operating systems through a single implementation. It delivers isolation, monitoring, and protection capabilities to multiple guest domains simultaneously, reducing overall system complexity compared to implementing separate security mechanisms in each guest OS.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Systems, methods, computer readable media and articles of manufacture consistent with innovations herein are directed to computer virtualization, computer security and/or data isolation. According to some illustrative implementations, innovations herein may utilize and/or involve a separation kernel hypervisor which may include the use of a guest operating system virtual machine protection domain, a virtualization assistance layer, and/or a rootkit defense mechanism (which may be proximate in temporal and/or spatial locality to malicious code, but isolated from it), inter alia, for detection and/or prevention of malicious code, for example, in a manner/context that is isolated and not able to be corrupted, detected, prevented, bypassed, and/or otherwise affected by the malicious code.