Systems and methods involving features of hardware virtualization such as separation kernel hypervisors, hypervisors, hypervisor guest context, hypervisor contest, rootkit detection/prevention, and/or other features

• US 9,218,489 B2
• Filed: 06/02/2014
• Issued: 12/22/2015
• Est. Priority Date: 06/26/2012
• Status: Active Grant

• Current Assignee: Lynx Software Technologies Inc.
• Original Assignee: Lynx Software Technologies Inc.
• Inventors: Mooring, Edward T., Yankovsky, Phillip
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): DE JESUS LASSALA, CARLOS MANUEL
• Application Number:
  US14/294,022
• Publication Number:
  US 20150007326A1
• Time in Patent Office: 568 Days
• US Class Current: 1/1
• CPC Class Codes: G06F 13/28 using burst mode transfer, e.g. direct memory access DMA, cycle steal G06F13/32 takes precedence
• CPC Class Codes: G06F 13/4221 being an input/output bus, e.g. ISA bus, EISA bus, PCI bus, SCSI bus
• CPC Class Codes: G06F 2009/45587 Isolation or security of virtual machine instances
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/556 involving covert channels, i.e. data leakage between processes inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 2221/2125 Just-in-time application of countermeasures, e.g., on-the-fly decryption, just-in-time obfuscation or de-obfuscation
• CPC Class Codes: G06F 9/45533 Hypervisors; Virtual machine monitors
• CPC Class Codes: G06F 9/45545 Guest-host, i.e. hypervisor is an application program itself, e.g. VirtualBox
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects

Abstract

Systems, methods, computer readable media and articles of manufacture consistent with innovations herein are directed to computer virtualization, computer security and/or data isolation. According to some illustrative implementations, innovations herein may utilize and/or involve a separation kernel hypervisor which may include the use of a guest operating system virtual machine protection domain, a virtualization assistance layer, and/or a rootkit defense mechanism (which may be proximate in temporal and/or spatial locality to malicious code, but isolated from it), inter alia, for detection and/or prevention of malicious code, for example, in a manner/context that is isolated and not able to be corrupted, detected, prevented, bypassed, and/or otherwise affected by the malicious code.

Claims

1. A method for processing information securely, the method comprising:

partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains; and

isolating the domains in time and/or space from each other;

hosting the plurality of quest operating system virtual machine protection domains by the separation kernel hypervisor;

providing a dedicated virtualization assistance layer (VAL) including a virtual representation of the hardware platform in each of the quest operating system virtual machine protection domains such that the dedicated VAL security processing is not performed in the separation kernel hypervisor;

hosting at least one malicious code defense mechanism that executes within the virtual hardware platform in each of the plurality of quest operating system virtual machine protection domains via the separation kernel hypervisor;

upon detection of a disk sector access attempt, securely transition execution to the malicious code defense mechanism within the VAL in a manner isolated from the quest operating system;

securely determining, via the malicious code defense mechanism, a policy decision regarding the disk sector access attempt; and

transitioning execution back to the separation kernel hypervisor to continue processing regarding enforcement of or taking action in connection with the policy decision.

2. The method of claim 1, further comprising one or more of:

implementing at least one or both of a routine or component to prohibit the guest operating system virtual machine protection domains from tampering with, one or both of corrupting or, bypassing the malicious code defense mechanism;

executing the malicious code defense mechanism while one or both of preventing interference or bypassing by the plurality of guest operating system virtual machine protection domains.

3. The method of claim 1, wherein:

the plurality of guest operating system virtual machine protection domains includes corresponding guest operating systems;

wherein the loss of security in one of the guest operating system virtual machine protection domains is isolated to the one lost security domain such that security is not broken in all the domains.

4. The method of claim 1, further comprising one or more of:

providing a dedicated virtualization assistance layer (VAL) is provided in each guest operating system such that the dedicated VAL security processing is not performed in the separation kernel hypervisor;

providing the guest operating system, the virtualization assistance layer and the malicious code defense mechanism are provided in the guest operating system virtual machine protection domains rather than in the separation kernel hypervisor;

or moving virtualization processing to subcomponents within each guest operating system such that the separation kernel hypervisor is of reduced size or complexity and substantially all analysis and security testing is performed within each guest operating system.

5. The method of claim 1, wherein one or both of:

as a function of the isolated domains, each of the domains detects their own disk sector access code;

or

the virtualization component within each domain is viewed as separate hardware by a guest such that bypass is prevented.

6. The method of claim 1, wherein the malicious code defense mechanism include one or both of subcomponents or subroutines configured for monitoring of guest operating system memory access, guest operating system Input/Output (I/O) port access, guest operating system PCI configuration space access, guest operating system virtual device interfaces, guest operating system device interfaces, Direct Memory Access (DMA) generated by the device with at least one of DMA engine, DMA capability, guest operating system firmware access, access to firmware interfaces, platform interfaces including sensitive platform interfaces, device plug-in, device unplugging, power management, virtual power management, activities, or state transitions.

7. The method of claim 1, wherein the malicious code defense mechanism include one or both of subcomponents or subroutines configured for monitoring actions of the guest operating system including at least one of observation, detection, mitigation, prevention, tracking, modification, reporting upon of code, data and execution flow, or resource utilization at one or both of runtime or static operation.

8. The method of claim 1, further comprising:

monitoring via the malicious code defense mechanism for malicious/suspect code;

ascertaining where code is operating, hiding, halted, stalled, infinitely looping, making no progress beyond intended execution, stored, once-active, extinct or not present but having performed a suspect action, in a position to maliciously affect a resource under control of a hypervisor guest.

9. The method of claim 8, wherein the monitoring of code includes at least one of instrumented execution, instrumented debugging, a unit test, or a regression test.

10. The method of claim 1, further comprising:

executing one or more malicious code defense mechanism while preventing one or more of interference, corruption, tampering, or bypassing by the plurality of guest operating system virtual machine protection domains.

11. The method of claim 1, further comprising:

triggering entry of a disk sector access attempt into the separation kernel hypervisor upon execution of suspect code attempting to modify boot sectors of a boot device of the guest operating system;

transitioning execution of the disk sector access attempt from the separation kernel hypervisor to the virtualization assistance layer in a manner isolated from the guest operating system;

transitioning execution of the disk sector access attempt from the virtualization assistance layer to the malicious code defense mechanism;

examining, by the malicious code defense mechanism, behavior of the guest operating system and determining a policy decision;

passing the policy decision and transitioning execution of the disk sector access attempt from the malicious code defense mechanism to the virtualization assistance layer;

passing the policy decision and transitioning execution of the disk sector access attempt from the virtualization assistance layer to the separation kernel hypervisor, wherein the separation kernel hypervisor executes an action based on the policy decision.

12. The method of claim 1, wherein suspect code attempts to copy, encrypt, hide and replace a Master Boot Record (MBR) of the boot device of the guest operating system.

13. A method for processing information securely involving a separation kernel hypervisor, the method comprising:

partitioning hardware platform resources to isolate in time and space a plurality of guest operating system virtual machine protection domains; and

executing the guest operating system virtual machine protection domains to provide an isolated and secure software execution environment;

hosting the plurality of quest operating system virtual machine protection domains by the separation kernel hypervisor;

providing a dedicated virtualization assistance layer (VAL) including a virtual representation of the hardware platform in each of the quest operating system virtual machine protection domains such that the dedicated VAL security processing is not performed in the separation kernel hypervisor;

hosting at least one malicious code defense mechanism that executes within the virtual hardware platform in each of the plurality of quest operating system virtual machine protection domains via the separation kernel hypervisor;

upon detection of a disk sector access attempt, securely transition execution to the malicious code defense mechanism within the VAL in a manner isolated from the quest operating system;

securely determining, via the malicious code defense mechanism, a policy decision regarding the disk sector access attempt; and

transitioning execution back to the separation kernel hypervisor to continue processing regarding enforcement of or taking action in connection with the policy decision.

14. The method of claim 13, wherein the hardware platform resources include one or more hardware elements including of at least one of a plurality of CPUs, buses and interconnects, main memory, network interface card, hard disk drives, solid state drive, graphics adaptor, audio device, input/output (I/O) device, serial I/O connector, USB connector, or Raid controller.

15. The method of claim 13, further comprising:

triggering entry of a disk sector access attempt into the separation kernel hypervisor upon execution of suspect code attempting to modify boot sectors of a boot device of the guest operating system;

transitioning execution of the disk sector access attempt from the separation kernel hypervisor to the virtualization assistance layer in a manner isolated from the guest operating system;

transitioning execution of the disk sector access attempt from the virtualization assistance layer to the malicious code defense mechanism;

examining, by the malicious code defense mechanism, behavior of the guest operating system and determining a policy decision;

passing the policy decision and transitioning execution of the disk sector access attempt from the malicious code defense mechanism to the virtualization assistance layer;

passing the policy decision and transitioning execution of the disk sector access attempt from the virtualization assistance layer to the separation kernel hypervisor, wherein the separation kernel hypervisor executes an action based on the policy decision.

16. The method of claim 13, wherein suspect code attempts to copy, encrypt, hide and replace a Master Boot Record (MBR) of the boot device of the guest operating system.

17. A method for processing information securely involving a separation kernel hypervisor, the method comprising:

partitioning hardware platform resources to isolate in time and space a plurality of guest operating system virtual machine protection domains;

executing the guest operating system virtual machine protection domains to provide an isolated and secure software execution environment, wherein each of the guest operating system virtual machine protection domains include a guest operating system, virtualization assistance layer (VAL) and a malicious code defense mechanism;

hosting the plurality of quest operating system virtual machine protection domains by the separation kernel hypervisor;

hosting at least one malicious code defense mechanism that executes within the virtual hardware platform in each of the plurality of quest operating system virtual machine protection domains via the separation kernel hypervisor;

upon detection of a disk sector access attempt, securely transition execution to the malicious code defense mechanism within the VAL in a manner isolated from the quest operating system;

securely determining, via the malicious code defense mechanism, a policy decision regarding the disk sector access attempt; and

transitioning execution back to the separation kernel hypervisor to continue processing regarding enforcement of or taking action in connection with the policy decision.

18. The method of claim 17, further comprising:

triggering entry of a disk sector access attempt into the separation kernel hypervisor upon execution of suspect code attempting to modify boot sectors of a boot device of the guest operating system;

transitioning execution of the disk sector access attempt from the separation kernel hypervisor to the virtualization assistance layer in a manner isolated from the guest operating system;

transitioning execution of the disk sector access attempt from the virtualization assistance layer to the malicious code defense mechanism;

examining, by the malicious code defense mechanism, behavior of the guest operating system and determining a policy decision;

passing the policy decision and transitioning execution of the disk sector access attempt from the malicious code defense mechanism to the virtualization assistance layer;

passing the policy decision and transitioning execution of the disk sector access attempt from the virtualization assistance layer to the separation kernel hypervisor, wherein the separation kernel hypervisor executes an action based on the policy decision.

19. The method of claim 17, wherein suspect code attempts to copy, encrypt, hide and replace a Master Boot Record (MBR) of the boot device of the guest operating system.