VMXroot Kernel Integrity Enforcement for Mandatory Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mandatory access control (MAC) mechanisms in operating systems are vulnerable to modifications by rogue Ring-0 subjects and require system reboots for policy updates, which is unacceptable in always-on environments like cloud and IoT computing, and are also susceptible to malicious access from co-processor devices.
Innovation Solution
A computing data security system utilizing virtual machine extension root (VMXroot) operations implements kernel integrity enforcement without reboots by using a hardware component with a policy wrapping key and a memory module, along with a VMXroot component that includes an extension monitor engine to monitor Ring-0 objects and enforce MAC policies dynamically, ensuring integrity and protection from unauthorized modifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If MAC policy updates require system reboot, then policy integrity is verified through secure boot mechanism, but system availability deteriorates in always-on environments
Solution Approach 1:
The patent applies preliminary action by establishing a trusted execution environment and securing the MAC policy in protected memory before system operation begins. The policy is pre-validated and locked in a secure state, allowing runtime updates without requiring reboot-based verification. This preliminary securing enables continuous operation while maintaining integrity.
Solution Approach 2:
The patent implements dynamics by transitioning from static policy enforcement (requiring reboot for updates) to dynamic policy updates within the trusted execution environment. The MAC policy can be modified at runtime through controlled interfaces while maintaining security guarantees, enabling continuous system availability without compromising integrity.
2Reliability
If LSM is part of OS TCB, then MAC enforcement is integrated into kernel, but vulnerability to Ring-0 threats increases
Solution Approach 1:
The patent applies segmentation by separating the MAC policy enforcement from the general kernel space. The policy is placed in a protected, isolated memory region accessible only through controlled interfaces. This segmentation creates a security boundary that protects the MAC enforcement mechanism from Ring-0 threats while maintaining integrated operation.
Solution Approach 2:
The patent introduces an intermediary trusted execution environment that mediates between the MAC policy and the kernel. This intermediary layer validates and controls access to the policy, preventing direct exposure to Ring-0 threats while maintaining enforcement capability. The intermediary acts as a buffer that preserves security without isolating the functionality.
3Productivity
If policy is stored in kernel memory, then MAC enforcement is efficient, but unauthorized modification risk increases
Solution Approach 1:
The patent applies local quality by implementing different memory protection characteristics for different regions. The MAC policy resides in a specifically protected memory region with restricted access permissions, while other kernel memory maintains standard accessibility. This localized protection ensures efficiency for enforced policies while providing enhanced security for the policy storage area.
Data Source
Figure 1
Figure 2A~2B
Figure 3
AI summary
Systems, apparatuses and methods may provide for conducting a signature verification of a mandatory access control policy and provisioning the mandatory access control policy into kernel memory if the signature verification is successful. Additionally, the kernel memory may be protected from unauthorized write operations by one or more processes having system level privileges. In one example, the mandatory access control policy is provisioned without a system reboot.