Layered Virtual Machine Integrity Monitoring via Randomized Timers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Recent cyber threats have become more sophisticated, targeting virtual machine monitors (VMMs) themselves, posing a significant challenge in maintaining the integrity and security of server-based computing services, especially in cloud computing environments where traditional security measures are insufficient.
Innovation Solution
A layered monitoring system utilizing independent processor elements, randomized timers, and interrupt controllers to continuously verify the integrity of VMMs by periodically checking their status and re-enabling interrupt controllers to ensure uninterrupted execution of integrity verification processes, transmitting results to a managing device for real-time monitoring and management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a VMM watcher is executed to verify integrity of the VMM, then security against compromise is improved, but execution time and system performance deteriorate due to interrupting normal VMM operations
Solution Approach 1:
The system implements periodic integrity verification of the VMM by the watcher at predetermined time intervals, rather than continuous monitoring. This allows the VMM to execute normally between verification periods, reducing execution interruption while still providing regular security checks to detect compromises.
Solution Approach 2:
The system performs preliminary actions by randomizing the timing of integrity verification executions. The watcher is triggered at unpredictable intervals based on randomized time values, which prevents attackers from predicting when verification occurs and planning attacks accordingly, while still maintaining regular verification frequency.
2Measurement precision
If the interrupt controller is disabled during VMM watcher execution, then monitoring accuracy is improved by preventing interruptions, but system responsiveness deteriorates during the monitoring period
Solution Approach 1:
The interrupt controller is disabled only during brief periodic intervals when the watcher executes integrity verification, rather than being continuously disabled. This limits the impact on system responsiveness to short, predictable periods while ensuring accurate monitoring during verification windows.
Solution Approach 2:
The system dynamically adjusts interrupt controller state based on watcher execution needs. The interrupt controller is selectively disabled only when the watcher requires uninterrupted access to monitor VMM integrity, and re-enabled immediately afterward to restore normal system responsiveness, creating a dynamic balance between monitoring accuracy and system performance.
3Object-affected harmful factors
If multiple timer values are randomized for watcher execution, then predictability of attacks is reduced, but system complexity increases
Solution Approach 1:
The timer functionality is segmented into multiple independent timer values (first timer value, second timer value, third timer value) that can be independently randomized and managed. This segmentation allows the system to distribute the randomization logic across separate timer components, reducing the complexity of managing a single complex randomized timer while achieving the same goal of preventing attack predictability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Various embodiments are generally directed to the provision and use of various hardware and software components of a computing device to monitor the state of layered virtual machine (VM) monitoring software components. An apparatus includes a first processor element; and logic to receive an indication that a first timer has reached an end of a first period of time, monitor execution of a VMM (virtual machine monitor) watcher by a second processor element, determine whether the second processor element completes execution of the VMM watcher to verify integrity of a VMM before a second timer reaches an end of a second period of time, and transmit an indication of the determination to a computing device. Other embodiments are described and claimed.