Tree Structure for Protecting Virtual Machine Memory Page Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtual machine (VM) systems face challenges in protecting guest integrity drivers from kernel-level attacks and malicious programs that attempt to tamper with memory pages or interfere with the integrity monitoring mechanism, necessitating robust protection mechanisms to ensure the integrity of the VM's security framework.
Innovation Solution
Implementing a guest integrity driver that operates in integrity mode, requesting the hypervisor to monitor specific memory pages and notify the driver of any writes, using a tree structure to protect protection data and employing hypercalls to manage memory page monitoring and alert actions, while ensuring only trusted execution can enter integrity mode to prevent malicious interference.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a guest integrity driver is implemented to monitor memory pages in real-time, then the ability to detect malicious activity is improved, but the driver becomes vulnerable to kernel-level attacks and tampering
Solution Approach 1:
The patent segments the monitoring system into distinct components: the guest integrity driver in the virtual machine, the hypervisor in the host system, and separate data structures (protection data, page information) stored in different memory locations. This segmentation isolates the driver from direct access to critical monitoring data, preventing tampering while maintaining detection capabilities.
Solution Approach 2:
The patent introduces the hypervisor as an intermediary between the guest integrity driver and the physical memory monitoring mechanisms. The hypervisor validates and mediates all access to protection data and monitored pages, ensuring that the driver cannot be tampered with by kernel-level attacks while still enabling comprehensive monitoring.
2Ease of operation
If protection data is stored in memory pages accessible to the guest OS, then the integrity monitoring can function, but malicious code can tamper with the protection data itself
Solution Approach 1:
The patent implements a nested structure where guest virtual memory pages are mapped to guest physical memory pages, which are in turn mapped to host physical memory pages. The protection data is stored in host physical memory pages that are inaccessible to the guest OS, creating nested layers of protection where inner layers protect against attacks from outer layers.
Solution Approach 2:
The patent adds a new dimension of protection by storing protection data in a separate address space (host physical memory) that is orthogonal to the guest memory space. This dimensional separation allows the monitoring system to function while preventing tampering, as malicious code in the guest space cannot reach into the host space to corrupt protection data.
3Reliability
If the hypervisor monitors all memory pages for writes, then complete security monitoring is achieved, but system performance deteriorates due to the overhead of monitoring every page
Solution Approach 1:
The patent applies local quality by differentiating between monitored and non-monitored memory pages. Instead of uniformly monitoring all pages, the system selectively monitors only those pages marked with protection data, reducing the monitoring overhead while maintaining complete security coverage for critical pages.
Solution Approach 2:
The patent implements partial monitoring by focusing resources on monitoring only the pages that contain protection data or are explicitly marked for monitoring. This partial action approach achieves sufficient security coverage without the excessive overhead of monitoring every single memory page in the system.
4Ease of operation
If an entry point for integrity mode is established, then controlled access to monitoring functions is improved, but the entry point itself becomes a target for attacks
Solution Approach 1:
The patent implements preliminary action by establishing the integrity mode entry point and configuring protection data before the guest OS and potential malicious code execute. The hypervisor pre-configures the monitoring structures and validates the entry point, ensuring that even if attackers target the entry point, the protective structures are already in place to detect and prevent exploitation.
Data Source
AI summary
Mechanisms to protect the integrity of a data structure that is traversed to locate protected memory pages are provided. Leaf nodes of the data structure store mappings that indicate which memory pages are protected. Both the pages indicated by the mappings and the pages that store the data structure are monitored by a tracing service that sends a notification to the hypervisor when a write to a traced page occurs. When system software receives such a notification, the system software traverses the data structure to determine whether any of the memory pages of the data structure is the traced page that was written to. If so, the alert action for that page is performed. If not, the system software determines whether any of the mappings in the leaf nodes include such a page and, if so, the alert action for that page is performed.