Systems and methods involving features of hardware virtualization such as separation kernel hypervisors, hypervisors, hypervisor guest context, hypervisor context, rootkit detection/prevention, and/or other features
First Claim
1. A method of processing information involving a separation kernel hypervisor, the method comprising:
- partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains;
isolating the domains in time and space from each other;
hosting the plurality of quest operating system virtual machine protection domains by the separation kernel hypervisor;
providing a dedicated virtualization assistance layer (VAL) including a virtual representation of the hardware platform in each of the quest operating system virtual machine protection domains such that the dedicated VAL security processing is not performed in the separation kernel hypervisor;
hosting at least one malicious code defense mechanism that executes within the virtual hardware platform in each of the plurality of quest operating system virtual machine protection domains via the separation kernel hypervisor;
triggering entry into the separation kernel hypervisor upon execution of code involving an I/O port access attempt in a suspect guest operating system;
transitioning execution of the access attempt from the separation kernel hypervisor to the virtualization assistance layer in a manner isolated from the suspect guest operating system;
transitioning execution of the access attempt from the virtualization assistance layer to a malicious code defense mechanism;
analyzing by the malicious code defense mechanism behavior of the suspect guest operating system and determining a policy decision;
passing the policy decision and transitioning execution of the access attempt from the malicious code defense mechanism to the virtualization assistance layer; and
passing the policy decision and transitioning execution of the access attempt from the virtualization assistance layer to the separation kernel hypervisor, wherein the separation kernel hypervisor performs enforcement or executes an action based on the policy decision.
3 Assignments
0 Petitions
Accused Products
Abstract
Systems, methods, computer readable media and articles of manufacture consistent with innovations herein are directed to computer virtualization, computer security and/or data isolation. According to some illustrative implementations, innovations herein may utilize and/or involve a separation kernel hypervisor which may include the use of a guest operating system virtual machine protection domain, a virtualization assistance layer, and/or a rootkit defense mechanism (which may be proximate in temporal and/or spatial locality to malicious code, but isolated from it), inter alia, for detection and/or prevention of malicious code, for example, in a manner/context that is isolated and not able to be corrupted, detected, prevented, bypassed, and/or otherwise affected by the malicious code.
-
Citations
27 Claims
-
1. A method of processing information involving a separation kernel hypervisor, the method comprising:
-
partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains;
isolating the domains in time and space from each other;hosting the plurality of quest operating system virtual machine protection domains by the separation kernel hypervisor; providing a dedicated virtualization assistance layer (VAL) including a virtual representation of the hardware platform in each of the quest operating system virtual machine protection domains such that the dedicated VAL security processing is not performed in the separation kernel hypervisor; hosting at least one malicious code defense mechanism that executes within the virtual hardware platform in each of the plurality of quest operating system virtual machine protection domains via the separation kernel hypervisor; triggering entry into the separation kernel hypervisor upon execution of code involving an I/O port access attempt in a suspect guest operating system; transitioning execution of the access attempt from the separation kernel hypervisor to the virtualization assistance layer in a manner isolated from the suspect guest operating system; transitioning execution of the access attempt from the virtualization assistance layer to a malicious code defense mechanism; analyzing by the malicious code defense mechanism behavior of the suspect guest operating system and determining a policy decision; passing the policy decision and transitioning execution of the access attempt from the malicious code defense mechanism to the virtualization assistance layer; and passing the policy decision and transitioning execution of the access attempt from the virtualization assistance layer to the separation kernel hypervisor, wherein the separation kernel hypervisor performs enforcement or executes an action based on the policy decision. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14)
-
-
15. A method of processing information involving a separation kernel hypervisor, the method comprising:
-
partitioning hardware platform resources to isolate in time and space a plurality of guest operating system virtual machine protection domains; executing the guest operating system virtual machine protection domains to provide an isolated and secure software execution environment, wherein each of the guest operating system virtual machine protection domains include a guest operating system, virtualization assistance layer and a malicious code defense mechanism; hosting the plurality of guest operating system virtual machine protection domains by the separation kernel hypervisor; hosting, via the separation kernel hypervisor, one or more malicious code defense mechanisms that each execute within a corresponding and respective protection domain of the plurality of guest operating system virtual machine protection domains; triggering entry into the separation kernel hypervisor upon execution of code involving an I/O port access attempt in a suspect guest operating system; transitioning execution of the access attempt from the separation kernel hypervisor to the virtualization assistance layer in a manner isolated from the suspect guest operating system; transitioning execution of the access attempt from the virtualization assistance layer to a malicious code defense mechanism; analyzing by the malicious code defense mechanism behavior of the suspect guest operating system and determining a policy decision; passing the policy decision and transitioning execution of the access attempt from the malicious code defense mechanism to the virtualization assistance layer; and passing the policy decision and transitioning execution of the access attempt from the virtualization assistance layer to the separation kernel hypervisor, wherein the separation kernel hypervisor performs enforcement or executes an action based on the policy decision. - View Dependent Claims (16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27)
-
Specification