Virtual Device Driver Architecture for Hardware Resource Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing virtualized systems face challenges in managing and controlling access to hardware resources across multiple user space instances, particularly in enterprise environments, where secure and efficient sharing and isolation of resources are necessary to meet Mobile Device Management (MDM) requirements.
Innovation Solution
The system employs a virtual device driver architecture that forwards driver messages between hardware device drivers and virtual containers, allowing for centralized control and filtering of access to hardware resources, enabling multiple virtual containers to share resources while maintaining isolation and reducing the attack surface by using virtual device drivers instead of direct access to hardware device drivers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If multiple virtual containers directly access hardware device drivers in kernel space, then hardware resource access is simplified, but system security and isolation are compromised
Solution Approach 1:
The patent introduces virtual device drivers as intermediary components between virtual containers and hardware device drivers. These virtual device drivers reside in user space and forward requests to the appropriate kernel space drivers, enabling controlled access while maintaining isolation. This mediator layer prevents direct access by virtual containers to kernel drivers, thereby securing the system while preserving functionality.
2Productivity
If hardware resources are shared among multiple virtual containers, then resource utilization increases, but access control and isolation become more complex
Solution Approach 1:
The patent segments the device driver functionality into virtual device drivers for each container and a master hardware device driver in kernel space. Each virtual device driver handles access control for its associated container, dividing the complex access control task into manageable segments. This segmentation enables multiple containers to share hardware resources while maintaining individual isolation and simplified control per container.
3Speed
If virtual containers have direct access to hardware device drivers, then access speed is improved, but the attack surface of the operating system increases
Solution Approach 1:
The virtual device driver acts as a security intermediary that filters and validates requests before forwarding them to hardware device drivers. This mediator layer blocks malicious or unauthorized access attempts while allowing legitimate requests to pass through with minimal overhead. The intermediary preserves access speed for authorized operations while significantly reducing the attack surface by preventing direct container-to-driver access.
4Device complexity
If a single hardware device driver is accessed by only one virtual container, then driver simplicity is maintained, but hardware resource sharing is limited
Solution Approach 1:
The patent makes the hardware device driver universal by enabling it to serve multiple virtual containers through the virtual device driver interface. The single hardware device driver in kernel space can handle requests from multiple virtual containers simultaneously, each managed by its own virtual device driver. This multi-functionality approach maintains driver simplicity while enabling broad hardware resource sharing across containers.
Data Source
AI summary
A system and method for virtual hardware control includes accessing, by a controller, a first driver message from at least one hardware device driver for at least one hardware resource on a user device, the at least one hardware device driver located in a kernel space on an operating system of the user device, sending, by the controller, the first driver message to a first virtual device driver, the first virtual device driver located in the kernel space, and forwarding, by the first virtual device driver, the first driver message to a first virtual container, the first virtual container being a first user space that is outside the kernel space of the operating system.