VM Introspection via Invisible Breakpoints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualized computing environments are vulnerable to malicious code, which can compromise the effectiveness of defense mechanisms, particularly in guest monitoring mode (GMM) modules that rely on guest agents to execute deferred guest calls, as malicious code can modify or disable these agents, leading to false reports and compromised security.
Innovation Solution
Implementing a secure guest monitoring mode (GMM) module that resides in an isolated memory space, using a bit mask and array of pointers for deferred guest calls, with invisible breakpoints and write traces to verify execution and detect modifications, ensuring independent verification of guest agent actions and preventing malicious code interference.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a guest agent is used to execute deferred guest calls in a virtualized computing environment, then the system can perform monitoring and security functions, but the system becomes vulnerable to malicious code that can modify or disable the guest agent
Solution Approach 1:
The patent segments the monitoring system into two independent parts: the guest agent running inside the VM and the GMM module running outside the VM in the hypervisor. This segmentation isolates the critical security verification functions from malicious code that may compromise the guest agent, allowing the GMM to independently verify agent actions without being affected by code injection or modification attacks.
Solution Approach 2:
The GMM module acts as an intermediary between the guest agent and the hypervisor security functions. It receives requests from the guest agent, executes them independently outside the VM context, and returns results to the hypervisor. This intermediary position allows the system to maintain security verification capabilities even when the guest agent is compromised, as the GMM operates in a trusted external environment.
2Measurement precision
If the GMM module executes deferred guest calls independently outside the VM, then it can verify agent actions authoritatively, but the system complexity increases due to additional verification mechanisms
Solution Approach 1:
The patent implements preliminary action by having the GMM module pre-execute deferred guest calls before the guest agent attempts to execute them. The GMM captures the expected results and compares them against the agent's actual execution. This preliminary execution approach ensures that verification is already in place before potential compromise can occur, maintaining high verification accuracy without requiring complex real-time monitoring infrastructure.
3Reliability
If invisible breakpoints and write traces are implemented to detect modifications, then the system can identify malicious code attempts, but the device complexity and overhead increase
Solution Approach 1:
The patent uses copying by creating a duplicate execution environment in the GMM module that mirrors the guest agent's operations. Instead of implementing complex monitoring mechanisms within the VM, the GMM copies the essential execution logic and compares results. This copying approach provides reliable integrity detection while keeping the monitoring mechanism relatively simple, as it leverages the existing agent code rather than requiring separate complex verification logic.
Data Source
AI summary
Example methods are provided for virtual machine introspection in which a guest monitoring mode (GMM) module monitors the execution of guest calls by an agent that resides in a virtual machine (VM). The GMM module sets a bit in bit mask that corresponds to a guest call that the agent needs to execute, and inserts an invisible breakpoint in the code of the guest call. If the GMM module detects that despite the setting of the bit in the bit mask, the agent does not complete the execution of the code (due to the invisible breakpoint not being triggered), then the GMM module considers this condition as a potential hijack of the VM by malicious code.