Granted Patent B2

US 8,694,738 · App. 13/271,102 · Granted Apr 8, 2014

Abstract

Claims (68)

1. A method comprising:

detecting an access attempt to a critical address space (CAS) of a guest operating system (OS) in a hypervisor environment comprising a hypervisor, wherein address space layout randomization (ASLR) is implemented by the guest OS;

identifying a process attempting the access; and

taking an action if the process is not permitted to access the CAS.

2. The method of claim 1 , wherein the detecting the access attempt comprises:

generating page table entries (PTEs) for pages corresponding to the CAS in a shadow page table of the hypervisor;

marking the PTEs such that the access attempt results in a page fault.

3. The method of claim 1 , wherein the identifying the process attempting the access comprises reading a CR3 register corresponding to the process.

4. The method of claim 1 , wherein the action is selected from:

reporting the access to a management console of the hypervisor;

providing a recommendation to the guest OS; and

automatically taking an action within the guest OS.

5. The method of claim 4 , wherein the reporting the access to a management console of the hypervisor includes flagging a status of the guest OS as infected.

6. The method of claim 4 , wherein the providing a recommendation to the guest OS comprises at least one of:

recommending that the process be blacklisted, until it is scanned and whitelisted by a security tool; or

running an anti-virus on the process.

7. The method of claim 4 , wherein the taking an action within the guest OS comprises at least one of:

running an anti-virus program in the guest OS; or

shutting down or saving a state of the guest OS for offline scanning.

8. The method of claim 1 , further comprising validating the access attempt using a policy, comprising:

denying the access if the process is executing from a writeable area of a memory element; and

permitting the access if the process is executing from a read-only area of the memory element.

9. The method of claim 1 , further comprising:

identifying a machine address corresponding to the CAS, the identifying the machine address comprising:

forcing a page fault in the guest OS;

resolving a guest physical address from a guest virtual address corresponding to the CAS; and

mapping the machine address to the guest physical address.

10. An apparatus comprising:

a memory element configured to store data; and

a computing processor operable to execute instructions associated with the data;

a hypervisor; and

an agent residing in a guest operating system (OS), such that the apparatus is configured for:

detecting an access attempt to a critical address space (CAS) of the guest OS in a hypervisor environment comprising the hypervisor, wherein address space layout randomization (ASLR) is implemented by the guest OS;

identifying a process attempting the access; and

taking an action if the process is not permitted to access the CAS.

11. The apparatus of claim 10 , wherein the detecting the access attempt comprises:

generating page table entries (PTEs) for pages corresponding to the CAS in a shadow page table of the hypervisor;

marking the PTEs such that the access attempt results in a page fault.

12. The apparatus of claim 10 , wherein the identifying the process attempting the access comprises reading a CR3 register corresponding to the process.

13. The apparatus of claim 10 , wherein the action is selected from:

reporting the access to a management console of the hypervisor;

providing a recommendation to the guest OS; and

automatically taking an action within the guest OS.

14. The apparatus of claim 10 , wherein the apparatus is further configured for:

identifying a machine address corresponding to the CAS, the identifying comprising:

forcing a page fault in the guest OS;

resolving a guest physical address from a guest virtual address corresponding to the CAS; and

mapping the machine address to the guest physical address.

15. Logic encoded in non-transitory media that includes code for execution and when executed by a processor is operable to perform operations comprising:

detecting an access attempt to a critical address space (CAS) of a guest operating system (OS) in a hypervisor environment comprising a hypervisor, wherein address space layout randomization (ASLR) is implemented by the guest OS;

identifying a process attempting the access; and

taking an action if the process is not permitted to access the CAS.

16. The logic of claim 15 , wherein the detecting the access attempt comprises:

generating page table entries (PTEs) for pages corresponding to the CAS in a shadow page table of the hypervisor;

marking the PTEs such that the access attempt results in a page fault.

17. The logic of claim 15 , wherein the identifying the process attempting the access comprises reading a CR3 register corresponding to the process.

18. The logic of claim 15 , wherein the action is selected from:

reporting the access to a management console of the hypervisor;

providing a recommendation to the guest OS; and

automatically taking an action within the guest OS.

19. The logic of claim 15 , further comprising validating the access attempt using a policy, comprising:

denying the access if the process is executing from a writeable area of a memory element; and

permitting the access if the process is executing from a read-only area of the memory element.

20. The logic of claim 15 , further comprising:

identifying a machine address corresponding to the CAS, the identifying comprising:

forcing a page fault in the guest OS;

resolving a guest physical address from a guest virtual address corresponding to the CAS; and

mapping the machine address to the guest physical address.

Assignments (9)