System and method for managing code isolation
View Patent ↗A computing system is configured to use a trampoline to isolate sensitive code in a virtual environment and in other applications. An import table may describe the entry points of a privileged code module or driver that generates privileged code. A system and method loads a shadow kernel to facilitate isolating the linkage between drivers and the rest of the system. The shadow kernel may be a copy of the operating system kernel that does not have the same integral position in the operation of the computing device. The shadow kernel may be used as a template for creating a jump table to redirect more critical privileged resource access requests from specially loaded kernel mode drivers to the PVM. All requests may pass through the PVM, which redirects non-critical functions to the original kernel. Multiple copies of a given driver or code module may be loaded in a given session.
1. A computer comprising:
at least one processor; and
memory storing executable instructions configured to, when executed by the at least one processor, cause the computer to:
instantiate a first kernel in a host environment of the computer, wherein the host environment includes a second kernel with an export table generated according to operating system rules of the computer;
receive, by the first kernel, a privileged resource request associated with a privileged space of the host environment that is isolated from non-privileged space of the host environment;
determine, by the first kernel, whether to redirect the privileged resource request to a process virtual machine (PVM) or the second kernel; and
based on the determination, transmit, by the first kernel, the privileged resource request to the PVM or the second kernel.
2. The computer of claim 1 , wherein the PVM is located in the privileged space of the host environment and wherein the memory further stores executable instructions configured to, when executed by the at least one processor, cause the computer to:
based on instructions in the privileged resource request and a table of rules specified in the second kernel, create, by the PVM, a PVM export table.
3. The computer of claim 1 , wherein the privileged resource request comprises a request to an isolated application programming interface (API) associated with a privileged driver.
4. The computer of claim 3 , wherein the privileged resource request is a blocking call to a resource.
5. The computer of claim 3 , wherein the privileged resource request is a non-blocking call to a resource.
6. A computer comprising:
at least one processor; and
memory storing executable instructions configured to, when executed by the at least one processor, cause the computer to:
instantiate a process virtual machine (PVM) in a privileged space of a host environment of the computer, wherein the privileged space is isolated from non-privileged space of the host environment;
configure the PVM to receive a privileged resource request associated with the privileged space;
configure the PVM to receive a non-privileged resource request from an application resident in the non-privileged space; and
configure the PVM to modify at least one of the privileged resource request or the non-privileged resource request to create one or more modified resource requests.
7. The computer of claim 6 , wherein the memory further stores executable instructions configured to, when executed by the at least one processor, cause the computer to:
configure the PVM to create an export table based on instructions contained in a resource request received by the PVM and a table of rules specified in an operating system (OS) kernel; and
configure the PVM to create the one or more modified resource requests based on the export table.
8. The computer of claim 6 , wherein the privileged resource request is a blocking call to a resource.
9. The computer of claim 6 , wherein the privileged resource request is a non-blocking call to a resource.
10. The computer of claim 7 , wherein the memory further stores executable instructions configured to, when executed by the at least one processor, cause the computer to:
instantiate a second kernel, wherein the second kernel is a copy of the OS kernel.
11. The computer of claim 10 , wherein the memory further stores executable instructions configure to, when executed by the at least one processor, cause the computer to:
configure the second kernel to determine whether to redirect the privileged resource request to the PVM or the OS kernel based.
12. The computer of claim 11 , wherein determining whether to redirect is based on one or more OS kernel rules.
13. A method comprising:
instantiating a first kernel in a host environment of a computer, wherein the host environment includes a second kernel with an export table generated according to operating system rules of the computer;
receiving, by the first kernel, a privileged resource request associated with a privileged space of the host environment that is isolated from non-privileged space of the host environment;
determining, by the first kernel, whether to redirect the privileged resource request to a process virtual machine (PVM) or the second kernel; and
based on the determination, transmitting, by the first kernel, the privileged resource request to the PVM or the second kernel.
14. The method of claim 13 , wherein the second kernel is an operating system (OS) kernel and the first kernel is a copy of the OS kernel.
15. The method of claim 13 , further comprising:
receiving, by the PVM, the privileged resource request;
modifying, by the PVM, the privileged resource request; and
transmitting the modified privileged resource request to the second kernel.
16. The method of claim 15 , wherein modifying the privileged resource request comprises creating an export table based on instructions included in the privileged resource request and a table of rules specified in the second kernel.
17. A non-transitory computer-readable medium configured to, when executed, cause an apparatus to:
instantiate a first kernel in a host environment, wherein the host environment includes a second kernel with an export table generated according to operating system rules of the computer;
receive, by the first kernel, a privileged resource request associated with a privileged space of the host environment that is isolated from non-privileged space of the host environment;
determine, by the first kernel, whether to redirect the privileged resource request to a process virtual machine (PVM) or the second kernel; and
based on the determination, transmit, by the first kernel, the privileged resource request to the PVM or the second kernel.
18. A method comprising:
instantiating a process virtual machine (PVM) in a privileged space of a host environment of a computer, wherein the privileged space is isolated from non-privileged space of the host environment;
configuring the PVM to receive a privileged resource request associated with the privileged space;
configuring the PVM to receive a non-privileged resource request from an application resident in the non-privileged space; and
configuring the PVM to modify at least one of the privileged resource request or the non-privileged resource request to create one or more modified resource requests.
19. The method of claim 18 , further comprising:
configuring the PVM to create an export table based on instructions contained in a resource request received by the PVM and a table of rules specified in an operating system (OS) kernel; and
configuring the PVM to create the one or more modified resource requests based on the export table.