Virtual Machine Manager Code Obfuscation via Trap-and-Emulate
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In virtual machine environments, existing technologies face challenges in securely obfuscating program code to prevent unauthorized access and reverse engineering, especially when multiple guest operating systems conflict over shared hardware resources, leading to complex arbitration and potential security breaches.
Innovation Solution
Implementing a virtual machine manager that monitors and performs trap-and-emulate operations on obfuscated trapping events, allowing it to take control of guest operating systems and execute operations in a way that conceals the logical flow, making it difficult for static analysis to determine the actual operations performed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If trap-and-emulate operations are implemented to obfuscate program code, then security against reverse engineering is improved, but device complexity increases
Solution Approach 1:
The virtual machine manager acts as an intermediary layer between the guest operating system and the physical hardware. It intercepts trapping events generated by obfuscated code and performs emulation operations, thereby hiding the true logical flow from static analysis while maintaining system functionality. This mediator approach enables code obfuscation without requiring fundamental changes to the underlying hardware or operating system architecture.
2Reliability
If virtual machine manager takes control of guest operating systems to perform trap-and-emulate operations, then code obfuscation effectiveness is improved, but operation speed deteriorates
Solution Approach 1:
The virtual machine manager does not intercept all operations, but only specific trapping events that are relevant to code obfuscation. By selectively monitoring and emulating only the necessary trapping events rather than all operations, the system achieves effective code obfuscation while minimizing the performance overhead associated with constant interception and emulation.
3Productivity
If multiple guest operating systems share hardware resources, then resource utilization is improved, but arbitration complexity increases
Solution Approach 1:
The virtual machine manager implements a universal arbitration mechanism that handles multiple guest operating systems through a single, unified interface. This multi-functional approach allows the same virtual machine manager to manage diverse operating systems and workloads, simplifying the arbitration process compared to having separate management systems for each guest OS while still achieving efficient resource utilization.
Data Source
AI summary
Techniques are presented for obfuscating programs of virtual machines. On a virtual machine hosted by a physical device, a program is run that is configured to execute one or more operations. At a virtual machine manager hosted by the physical device and configured to manage the virtual machine, execution of the program is monitored to detect a trapping event that causes the virtual machine manager to take over operation of the program. Upon detecting the trapping event, a specific operation of the program is performed that differs from an operation implied by static analysis of the program.