Virtualization Layer Memory Protection via Nested Page Tables
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The virtualization layer in malware detection architectures is unable to discern higher-level context data, such as application types or version information, and lacks mechanisms to protect the integrity, confidentiality, and availability of the guest agent, making it susceptible to malicious attacks.
Innovation Solution
The virtualization layer employs a micro-hypervisor with nested page tables and an interrupt service routine to restrict access to guest agent memory pages, ensuring their integrity, confidentiality, and availability by altering permissions and injecting virtual interrupts to guarantee execution time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the virtualization layer uses a guest agent to provide metadata for exploit detection, then the detection capability is improved, but the security of the guest agent is compromised because it operates at the same privilege level as malware
Solution Approach 1:
The system segments the virtualization architecture into multiple privilege levels: a privileged virtualization layer (hypervisor) and unprivileged guest processes. The guest agent functionality is moved into the privileged virtualization layer, separating it from the unprivileged guest OS where malware operates. This segmentation allows the agent to provide metadata for exploit detection while being protected from malware attacks through privilege isolation.
Solution Approach 2:
The privileged virtualization layer acts as an intermediary between the guest OS and the host system. It provides metadata about guest processes to the host without requiring the guest agent to operate at high privilege levels within the guest OS. This intermediary approach maintains detection capability while protecting the agent from direct exposure to malware in the guest environment.
2Quantity of substance
If the virtualization layer accesses low-level context data from the guest OS, then the information available for analysis is improved, but the ability to discern higher-level context such as application type and version is worsened
Solution Approach 1:
The privileged virtualization layer performs multiple functions: it accesses low-level context data (register values, memory addresses) for security analysis and simultaneously provides high-level metadata (process names, application types, version information) for application identification. This multi-functional approach resolves the contradiction by making both types of information available through a single unified layer.
Solution Approach 2:
The virtualization layer preliminarily processes and enriches raw context data from the guest OS with high-level metadata before presenting it to the host system. This preliminary action ensures that both low-level technical data and high-level application context are prepared and available simultaneously, eliminating the need to choose between them.
3Ease of operation
If the guest agent operates inside the guest OS to provide metadata, then the metadata delivery is simplified, but the agent becomes highly susceptible to malicious attacks
Solution Approach 1:
The system moves the guest agent from the horizontal dimension (operating within the guest OS at the same level as applications) to the vertical dimension (operating in the privileged virtualization layer above the guest OS). This dimensional change maintains the ability to deliver metadata while placing the agent in a protected environment isolated from malware that operates within the guest OS namespace.
Solution Approach 2:
The privileged virtualization layer implements preliminary protective measures by establishing privilege barriers before malware can attack the guest agent. The hypervisor's privileged position allows it to preemptively block malicious attempts to compromise the agent, preventing attacks rather than responding to them after occurrence.
Data Source
AI summary
A computerized method is provided for protecting processes operating within a computing device. The method comprises an operation for identifying, by a virtualization layer operating in a host mode, when a guest process switch has occurred. The guest process switch corresponds to a change as to an operating state of a process within a virtual machine. Responsive to an identified guest process switch, an operation is conducted to determine, by the virtualization layer, whether hardware circuitry within the computing device is to access a different nested page table for use in memory address translations. The different nested page table alters page permissions for one or more memory pages associated with at least the process that are executable in the virtual machine.