Threat-Aware Microvisor for Real-Time OS Security Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualization systems face challenges in detecting anomalous behavior of malware and collecting analytical information in a lightweight manner, leading to inefficiencies in resource management and security analysis.
Innovation Solution
A micro-virtualization architecture is introduced, deploying a threat-aware microvisor as a lightweight module beneath the operating system kernel to control access permissions to kernel resources, utilizing a type 0 virtual machine monitor (VMM) to instantiate virtual machines for anomaly detection and analysis, thereby facilitating real-time security analysis and threat intelligence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If policy enforcement and containment analysis are used to detect malicious code, then security detection capability is improved, but system resource consumption increases due to active analysis of operating system data streams
Solution Approach 1:
The patent segments the virtualization system into multiple layers: hardware, microvisor, hypervisor, and guest operating systems. The microvisor layer provides lightweight security monitoring by intercepting system calls and analyzing only critical data points, rather than performing active analysis of all operating system data streams. This segmentation allows security functions to operate with minimal resource consumption while maintaining detection capability.
Solution Approach 2:
The patent extracts the security analysis function from the guest operating system environment and places it in the microvisor layer, which operates at a lower level with direct hardware access. This extraction allows security monitoring to occur independently of the guest OS, reducing the need for resource-intensive active analysis within the guest environment while maintaining comprehensive detection capability.
2Adaptability or versatility
If full virtualization is implemented to support multiple operating system instances, then system versatility is improved, but device complexity increases due to hardware resource sharing and virtualization overhead
Solution Approach 1:
The patent divides the virtualization architecture into distinct segments: the microvisor layer for hardware resource management and security, the hypervisor layer for virtual machine orchestration, and guest OS instances for application execution. This segmentation allows each layer to perform its specific function with optimized complexity, reducing overall system complexity while maintaining versatility.
Solution Approach 2:
The microvisor acts as an intermediary layer between the hardware and the hypervisor/guest OS instances. It provides a standardized interface for resource access and security enforcement, simplifying the interaction between hardware and multiple virtual machines. This intermediary reduces the complexity of direct hardware sharing by abstracting resource management operations.
3Reliability
If program code and data structures are duplicated for each operating system instance, then isolation and security are improved, but memory consumption increases
Solution Approach 1:
The patent merges the security monitoring and isolation functions into the microvisor layer, which operates below all guest operating systems. This allows guest OS instances to share the underlying hardware resources and microvisor infrastructure, reducing memory consumption while maintaining isolation through the microvisor's capability to intercept and control system calls and resource access across all instances.
Data Source
AI summary
An architecture deployed to facilitate real-time security analysis, including exploit detection and threat intelligence, of operating system (OS) processes executed by a central processing unit (CPU). The architecture features memory configured to store a process, an OS kernel, a VMM and a virtualization module. The virtualization module is configured to communicate with the VMM and execute, at a privilege level of the CPU, to control access permissions to kernel resources accessible by the process. The VMM is configured to execute at a first privilege level of the virtualization module to expose the kernel resources to the OS kernel. The OS kernel is configured to execute at a second privilege level lower than the first privilege level of the virtualization module. The VMM is further configured to instantiate a virtual machine containing the OS kernel, where access to the kernel resources is controlled by the VMM and the virtual machine.