Systems and Methods Involving Features of Hardware Virtualization Such as Separation Kernel Hypervisors, Hypervisors, Hypervisor Guest Context, Hypervisor Contest, Rootkit Detection/Prevention, and/or Other Features

• US 20150007326A1
• Filed: 06/02/2014
• Published: 01/01/2015
• Est. Priority Date: 06/26/2012
• Status: Active Grant

• Current Assignee: Lynx Software Technologies Inc.
• Original Assignee: LynuxWorks Inc
• Inventors: Mooring, Edward T., Yankovsky, Phillip
• Granted Patent: US 9,218,489 B2
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 13/28 using burst mode transfer, e.g. direct memory access DMA, cycle steal G06F13/32 takes precedence
• CPC Class Codes: G06F 13/4221 being an input/output bus, e.g. ISA bus, EISA bus, PCI bus, SCSI bus
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2125 Just-in-time application of countermeasures, e.g., on-the-fly decryption, just-in-time obfuscation or de-obfuscation
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45545 Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Systems, methods, computer readable media and articles of manufacture consistent with innovations herein are directed to computer virtualization, computer security and/or data isolation. According to some illustrative implementations, innovations herein may utilize and/or involve a separation kernel hypervisor which may include the use of a guest operating system virtual machine protection domain, a virtualization assistance layer, and/or a rootkit defense mechanism (which may be proximate in temporal and/or spatial locality to malicious code, but isolated from it), inter alia, for detection and/or prevention of malicious code, for example, in a manner/context that is isolated and not able to be corrupted, detected, prevented, bypassed, and/or otherwise affected by the malicious code.

Claims

1. A method for processing information securely, the method comprising:

partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains; and

isolating and/or securing the domains in time and/or space from each other.

2. The method of claim 1, further comprising one or more of:

hosting the plurality of guest operating system virtual machine protection domains by the separation kernel hypervisor;

hosting/processing at least one malicious code and/or root kit defense mechanism, each which may be different from each other, that executes within one or more of the plurality of guest operating system virtual machine protection domains via the separation kernel hypervisor;

implementing at least one routine and/or component to prohibit the guest operating system virtual machine protection domains from tampering with, corrupting, and/or bypassing the malicious code and/or root kit defense mechanism(s); and

/or

executing the malicious code and/or root kit defense mechanism(s) while preventing interference and/or bypassing/corrupting/tampering by the plurality of guest operating system virtual machine protection domains.

3. The method of claim 1, wherein:

the plurality of guest operating system virtual machine protection domains includes corresponding guest operating systems; and

/or

wherein the loss of security in one of the guest operating system virtual machine protection domains is isolated to the one lost security domain such that security is not broken in all the domains.

5. The method of claim 1, wherein one or more of:

a dedicated virtualization assistance layer (VAL) is provided in each guest operating system such that the dedicated VAL security processing is not performed in the separation kernel hypervisor; and

/or

the guest operating system, the virtualization assistance layer and the root kit defense mechanism are provided in the guest operating system virtual machine protection domains rather than in the separation kernel hypervisor; and

/or

the separation kernel hypervisor is of reduced size/complexity via moving virtualization processing to subcomponents within each guest operating system such that substantially all analysis and security testing is performed within each guest operating system.

6. The method of claim 1, wherein:

as a function of the isolated domains, each of the domains detects their own suspect code; and

/or

wherein the virtualization component within each domain is viewed as separate hardware by a guest such that bypass is prevented.

7. The method of claim 1, wherein the malicious code and/or root kit defense mechanism(s) include subcomponents and/or subroutines configured for monitoring of guest operating system memory access, guest operating system Input/Output (I/O) port access, guest operating system PCI configuration space access, guest operating system virtual device interfaces, guest operating system device interfaces, DMA generated by the device with DMA engines and/or DMA capability, guest operating system firmware access, access to firmware interfaces, platform interfaces including sensitive platform interfaces, device plug-in, device unplugging, power management, virtual power management, activities, and/or state transitions.

8. The method of claim 1, wherein the malicious code and/or root kit defense mechanism(s) include subcomponents and/or subroutines configured for monitoring actions of the guest operating system including observation, detection, mitigation, prevention, tracking, modification, reporting upon of code, data and execution flow, and/or resource utilization at runtime and/or static operation.

9. The method of claim 1, further comprising:

monitoring via the malicious code and/or root kit defense mechanism(s) for malicious/suspect code;

ascertaining where code is operating, hiding, halted, stalled, infinitely looping, making no progress beyond intended execution, stored, once-active, extinct/not present but having performed suspect and/or malicious action, in a position to maliciously affect a resource under control of a hypervisor guest.

10. The method of claim 9, wherein the monitoring of code includes instrumented execution/debugging, a unit test, and/or a regression test.

11. The method of claim 1, further comprising:

executing one or more malicious code and/or root kit defense mechanism(s) while preventing interference and/or corruption/tampering/bypassing by the plurality of guest operating system virtual machine protection domains.

116. The method of claim 1, further comprising:

triggering entry of a disk sector access attempt into the separation kernel hypervisor upon execution of suspect code attempting to modify boot sectors of a boot device of the guest operating system;

transitioning execution of the disk sector access attempt from the separation kernel hypervisor to the virtualization assistance layer in a manner isolated from the guest operating system;

transitioning execution of the disk sector access attempt from the virtualization assistance layer to the malicious code and/or root kit defense mechanism(s);

examining, by the malicious code and/or root kit defense mechanism(s), behavior of the guest operating system and determining a policy decision;

passing the policy decision and transitioning execution of the disk sector access attempt from the malicious code and/or root kit defense mechanism to the virtualization assistance layer;

passing the policy decision and transitioning execution of the disk sector access attempt from the virtualization assistance layer to the separation kernel hypervisor, wherein the separation kernel hypervisor executes an action based on the policy decision.

117. The method of claim 1, wherein suspect code attempts to copy, encrypt, hide and replace a Master Boot Record (MBR) of the boot device of the guest operating system.

4. (canceled)

12. A method for processing information securely involving a separation kernel hypervisor, the method comprising:

partitioning hardware platform resources to isolate and/or secure in time and/or space a plurality of guest operating system virtual machine protection domains; and

executing the guest operating system virtual machine protection domains to provide an isolated and secure software execution environment.

13. The method of claim 12, wherein the hardware platform resources include one of at least a plurality of CPUs, buses and interconnects, main memory, network interface card, hard disk drives, solid state drive, graphics adaptor, audio device, input/output (I/O) device, serial I/O connector, USB connector, Raid controller.

118. The method of claim 12, further comprising:

triggering entry of a disk sector access attempt into the separation kernel hypervisor upon execution of suspect code attempting to modify boot sectors of a boot device of the guest operating system;

transitioning execution of the disk sector access attempt from the separation kernel hypervisor to the virtualization assistance layer in a manner isolated from the guest operating system;

transitioning execution of the disk sector access attempt from the virtualization assistance layer to the malicious code and/or root kit defense mechanism(s);

examining, by the malicious code and/or root kit defense mechanism(s), behavior of the guest operating system and determining a policy decision;

passing the policy decision and transitioning execution of the disk sector access attempt from the malicious code and/or root kit defense mechanism to the virtualization assistance layer;

passing the policy decision and transitioning execution of the disk sector access attempt from the virtualization assistance layer to the separation kernel hypervisor, wherein the separation kernel hypervisor executes an action based on the policy decision.

119. The method of claim 12, wherein suspect code attempts to copy, encrypt, hide and replace a Master Boot Record (MBR) of the boot device of the guest operating system.

14. A method for processing information securely involving a separation kernel hypervisor, the method comprising:

partitioning hardware platform resources to isolate and/or secure in time and/or space a plurality of guest operating system virtual machine protection domains;

executing the guest operating system virtual machine protection domains to provide an isolated and secure software execution environment, wherein each of the guest operating system virtual machine protection domains include a guest operating system, virtualization assistance layer and a malicious code and/or root kit defense mechanism.

83. The method of claim 14, further comprising:

triggering entry of a disk sector access attempt into the separation kernel hypervisor upon execution of suspect code attempting to modify boot sectors of a boot device of the guest operating system;

transitioning execution of the disk sector access attempt from the separation kernel hypervisor to the virtualization assistance layer in a manner isolated from the guest operating system;

transitioning execution of the disk sector access attempt from the virtualization assistance layer to the malicious code and/or root kit defense mechanism(s);

examining, by the malicious code and/or root kit defense mechanism(s), behavior of the guest operating system and determining a policy decision;

passing the policy decision and transitioning execution of the disk sector access attempt from the malicious code and/or root kit defense mechanism to the virtualization assistance layer;

passing the policy decision and transitioning execution of the disk sector access attempt from the virtualization assistance layer to the separation kernel hypervisor, wherein the separation kernel hypervisor executes an action based on the policy decision.

84. The method of claim 14, wherein suspect code attempts to copy, encrypt, hide and replace a Master Boot Record (MBR) of the boot device of the guest operating system.

15-82. -82. (canceled)

85-115. -115. (canceled)