VMXroot Kernel Integrity Enforcement for Mandatory Access Control

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing mandatory access control (MAC) mechanisms in operating systems are vulnerable to modifications by rogue Ring-0 subjects and require system reboots for policy updates, which is unacceptable in always-on environments like cloud and IoT computing, and are also susceptible to malicious access from co-processor devices.

Innovation Solution

A computing data security system utilizing virtual machine extension root (VMXroot) operations implements kernel integrity enforcement without reboots by using a hardware component with a policy wrapping key and a memory module, along with a VMXroot component that includes an extension monitor engine to monitor Ring-0 objects and enforce MAC policies dynamically, ensuring integrity and protection from unauthorized modifications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If MAC policy updates require system reboot, then policy integrity is verified through secure boot mechanism, but system availability deteriorates in always-on environments

Engineering Contradiction:
Improvepolicy integrityVSAvoidsystem availability
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent applies preliminary action by establishing a trusted execution environment and securing the MAC policy in protected memory before system operation begins. The policy is pre-validated and locked in a secure state, allowing runtime updates without requiring reboot-based verification. This preliminary securing enables continuous operation while maintaining integrity.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The patent implements dynamics by transitioning from static policy enforcement (requiring reboot for updates) to dynamic policy updates within the trusted execution environment. The MAC policy can be modified at runtime through controlled interfaces while maintaining security guarantees, enabling continuous system availability without compromising integrity.

Inventive Principle:
Principle #15Dynamics

2Reliability

If LSM is part of OS TCB, then MAC enforcement is integrated into kernel, but vulnerability to Ring-0 threats increases

Engineering Contradiction:
ImproveMAC enforcementVSAvoidRing-0 vulnerability
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies segmentation by separating the MAC policy enforcement from the general kernel space. The policy is placed in a protected, isolated memory region accessible only through controlled interfaces. This segmentation creates a security boundary that protects the MAC enforcement mechanism from Ring-0 threats while maintaining integrated operation.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary trusted execution environment that mediates between the MAC policy and the kernel. This intermediary layer validates and controls access to the policy, preventing direct exposure to Ring-0 threats while maintaining enforcement capability. The intermediary acts as a buffer that preserves security without isolating the functionality.

Inventive Principle:
Principle #24Intermediary (Mediator)

3Productivity

If policy is stored in kernel memory, then MAC enforcement is efficient, but unauthorized modification risk increases

Engineering Contradiction:
Improveenforcement efficiencyVSAvoidpolicy protection
Core Design Contradiction:
ProductivityVSReliability

Solution Approach 1:

The patent applies local quality by implementing different memory protection characteristics for different regions. The MAC policy resides in a specifically protected memory region with restricted access permissions, while other kernel memory maintains standard accessibility. This localized protection ensures efficiency for enforced policies while providing enhanced security for the policy storage area.

Inventive Principle:
Principle #3Local quality

Data Source

PatentEP3295357B1Integrity protection of a mandatory access control policy in an operating system using virtual machine extension root operations
Publication Date: 2019.10.23 INTEL CORP
  • EP3295357B1 patent drawingFigure 1
  • EP3295357B1 patent drawingFigure 2A~2B
  • EP3295357B1 patent drawingFigure 3

AI summary

Systems, apparatuses and methods may provide for conducting a signature verification of a mandatory access control policy and provisioning the mandatory access control policy into kernel memory if the signature verification is successful. Additionally, the kernel memory may be protected from unauthorized write operations by one or more processes having system level privileges. In one example, the mandatory access control policy is provisioned without a system reboot.