System Service Redirection Using Hardware-Protected Provider Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face security risks and inefficiencies due to the unsafe and unsecure practice of 'hooking' system service tables to intercept system service calls, which can lead to unauthorized modifications and potential abuse.
Innovation Solution
The implementation of secured system service redirection technology that dynamically loads verified service call providers into the operating system, leveraging virtualization-based security to create and maintain tamper-proof provider service tables, allowing secure rerouting of system service calls to registered providers, and providing value-added services like system call monitoring and sandboxing.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If system service tables are hooked to intercept system service calls, then system service call monitoring capability is improved, but security and data integrity are worsened due to unauthorized modifications
Solution Approach 1:
The patent introduces an intermediary layer (service call provider with provider service table) between the user-mode process and the operating system kernel. This intermediary securely intercepts and redirects system service calls without modifying the original system service table, thereby maintaining both monitoring capability and security integrity simultaneously
Solution Approach 2:
The patent segments the system service call handling into multiple components: the original operating system system service table, the intermediary provider service table, and the service call provider. This segmentation allows monitoring functionality to be added without compromising the integrity of the core system service table
2Adaptability or versatility
If system service tables are modified to redirect calls, then system service call filtering capability is improved, but security against unauthorized access is worsened
Solution Approach 1:
The provider service table acts as a secure intermediary that filters system service calls before they reach the kernel. It redirects calls to verified service call providers while maintaining security through hardware-enforced protection, preventing unauthorized access while enabling filtering functionality
Solution Approach 2:
The system performs preliminary verification and redirection at the provider service table level before calls reach the kernel. Service calls are filtered and validated in advance, preventing unauthorized access attempts from reaching vulnerable system components
3Reliability
If hardware protection is applied to provider service table, then data integrity is improved, but system complexity is worsened
Solution Approach 1:
The patent replaces software-based protection mechanisms with hardware-enforced memory protection. The processor's memory management hardware automatically enforces read-only access to the provider service table, eliminating the need for complex software validation and reducing overall system complexity while maintaining strong security
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Securely redirecting a system service routine via a provider service table. A service call provider is loaded within an operating system executing in a lower trust security zone. The service call provider comprises metadata indicating a system service routine to be redirected to the service call provider. Based on the metadata, a provider service table is built within a higher trust security zone. The service table redirects the system service routine to the service call provider. Memory page(s) associated with the provider service table are hardware protected, and a read-only view is exposed to the operating system. The provider service table is associated with a user-mode process. A service call for a particular system service routine is received by the operation system from the user-mode process and, based on the provider service table being associated with the user-mode process, the service call is directed to the service call provider.