Systems and methods involving features of hardware virtualization, hypervisor, pages of interest, and/or other features
Systems, methods, computer readable media and articles of manufacture consistent with innovations herein are directed to computer virtualization, computer security and/or memory access. According to some illustrative implementations, innovations herein may utilize and/or involve a separation kernel hypervisor which may include the use of a guest operating system virtual machine protection domain, a virtualization assistance layer, and/or a detection mechanism (which may be proximate in temporal and/or spatial locality to malicious code, but isolated from it), inter alia, for detection and/or notification of, and action by a monitoring guest upon access by a monitored guest to predetermined physical memory locations.
1. A method for processing information securely, the method comprising:
partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains;
isolating the domains in time and space from each other;
providing a list of memory locations of an authorized guest to another guest;
providing a message of the authorized guest to the another guest;
providing a virtualization assistance layer (VAL) including a virtual representation of the hardware platform in each of the guest operating system virtual machine protection domains such that the VAL is not directly accessible by the authorized guest;
hosting a mechanism to unmap specified pages on demand from another guest;
processing an unmapped page exception taken by the virtual machine;
mapping the previously unmapped page;
sending a notification of memory access and associated context information to a requesting guest, wherein the virtual machine comprises a virtual motherboard including a virtual CPU and memory by the VAL;
allowing the virtual machine to execute a single instruction;
returning control to the VAL;
mapping the page as inaccessible again; and
returning control to the virtual machine.
2. A method for processing information securely, the method comprising:
partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains;
isolating the domains in time and space from each other;
providing a list of memory locations of an authorized guest to another guest;
providing a message of the authorized guest to the another guest;
providing a virtualization assistance layer (VAL) including a virtual representation of the hardware platform in each of the guest operating system virtual machine protection domains such that the VAL is not directly accessible by the authorized guest;
hosting a mechanism to unmap specified pages on demand from another guest;
processing an unmapped page exception taken by the virtual machine;
mapping the previously unmapped page;
sending a notification of memory access and associated context information to a requesting guest, wherein the virtual machine comprises a virtual motherboard including a virtual CPU and memory by the VAL;
allowing the virtual machine to execute a single instruction;
returning control to the VAL;
mapping the page as inaccessible again;
returning control to the virtual machine; and
configuring a memory management unit such that software in the virtual machine cannot undo the mapping.
3. The method of claim 2 , further comprising one or more of:
hosting/processing at least one detection mechanism, each which may be different from each other, that executes within one or more of the plurality of guest operating system virtual machine protection domains via the separation kernel hypervisor;
implementing at least one routine and/or component to prohibit the guest operating system virtual machine protection domains from tampering with, corrupting,
and/or bypassing the detection mechanism(s); and/or
executing the detection mechanism(s) while preventing interference and/or bypassing/corrupting/tampering by the plurality of guest operating system virtual machine protection domains;
hosting a mechanism to process a page of the virtual machine of a first guest by a second guest; and
sending a notification associated with the virtual machine of the first guest to the second guest.
4. The method of claim 3 , further comprising one or more of:
hosting an unmapping mechanism to unmap the page; and
unmapping, via the unmapping mechanism, the page.
5. The method of claim 4 , further comprising one or more of:
hosting a remapping mechanism to remap unmapped pages;
transitioning execution to the remapping mechanism;
remapping, via the remapping mechanism, the unmapped pages as accessible;
and transitioning, via the remapping mechanism; execution to the detection mechanism.
6. The method of claim 2 , further comprising one or more of:
hosting a mechanism to unmap specified pages on demand from another guest;
processing an unmapped page exception taken by the virtual machine;
mapping the previously unmapped page; and/or
sending a notification of memory access and associated context information to a requesting guest.
7. The method of claim 2 wherein the memory management unit is configured such that software in the virtual machine cannot undo the unmapping.
8. The method of claim 2 wherein the memory management unit is configured such that software in the virtual machine cannot undo remapping.
9. The method of claim 2 , further comprising one or more of:
implementing at least one routine and/or component to prohibit the guest operating systems from tampering with, corrupting, and/or bypassing the detection mechanism(s); and
executing the detection mechanism(s) while preventing interference and/or bypassing, corrupting, tampering by the plurality of guest operating systems.
10. The method of claim 2 , wherein:
the plurality of guest operating system virtual machine protection domains includes corresponding guest operating systems; and
wherein isolating the loss of security in one of the guest operating system virtual machine protection domains to the one lost security domain such that security is not broken in all the domains.
11. The method of claim 2 , wherein:
moving virtualization processing to the virtual hardware platforms within each guest operating system protection domain so that substantially all analysis and security testing is performed within each guest operating system protection domain such that the separation kernel hypervisor is of reduced size/complexity.
12. The method of claim 2 , wherein:
detecting in each of the domains their own malicious code as a function of the isolated domains; or wherein viewing the virtual hardware platform within each domain as separate hardware by a guest such that bypass is prevented.
13. The method of claim 2 , wherein the detection mechanism(s) include subcomponents and/or subroutines configured for monitoring of guest operating system memory access.
14. The method of claim 2 , wherein the detection mechanism(s) include subcomponents and/or subroutines configured for monitoring actions of the guest operating system including observation, detection, and/or tracking of code, data, execution flow, and/or resource utilization at runtime.
15. The method of claim 2 further comprising:
monitoring, via at least one detection mechanism, for suspect code;
ascertaining where code is operating, hiding, halted, stalled, infinitely looping, making no progress beyond intended execution, stored, once-active, extinct, not present but having performed suspect and/or malicious action, and/or in a position to maliciously affect a resource under control of a hypervisor guest.
16. The method of claim 2 , further comprising:
executing one or more detection mechanism(s) while preventing interference and/or corruption/tampering/bypassing by the plurality of guest operating system virtual machine protection domains.
17. The method of claim 2 , wherein the detection mechanism(s) include subcomponents and/or subroutines configured for monitoring actions of the guest operating system including mitigation, prevention, and/or modification of code, data, execution flow, and/or resource utilization at runtime, as detected by the detection mechanism.
18. The method of claim 2 , wherein the detection mechanism(s) include subcomponents and/or subroutines configured for monitoring actions of the guest operating system including reporting upon of suspect code, data, execution flow, and/or resource utilization at runtime, as detected by the detection mechanism.
19. The method of claim 2 , further comprising:
enforcing policy for activities monitored by the detection mechanism(s) within the guest operating system virtual machine protection domain.
20. The method of claim 2 , wherein the virtualization assistance layer virtualizes portions of the hardware platform resources including a virtual CPU/ABI, a virtual chipset ABI, a set of virtual devices, a set of physical devices, and firmware exported to the corresponding guest operating system.
21. The method of claim 2 , further comprising:
polling memory assigned to the guest operating system by at least one of the detection mechanisms.
22. The method of claim 2 , further comprising:
monitoring patterns of guest operating system memory access by at least one of the detection mechanism based on a feedback mechanism.
23. The method of claim 2 , wherein guest operating system memory includes any of an interrupt descriptor table, global descriptor table and local descriptor table and an application hosted by the guest operating system.
24. The method of claim 2 , further comprising:
hosting an unmapping mechanism to unmap the page; and
unmapping, via the unmapping mechanism, the page.
25. A method for processing information securely, the method comprising:
partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains;
isolating the domains in time and space from each other;
providing a list of memory locations of an authorized guest to another guest;
providing a message of the authorized guest to the another guest;
providing a virtualization assistance layer (VAL) including a virtual representation of the hardware platform in each of the guest operating system virtual machine protection domains such that the VAL is not directly accessible by the authorized guest;
hosting a mechanism to unmap specified pages on demand from another guest;
processing an unmapped page exception taken by the virtual machine;
mapping the previously unmapped page; and
sending a notification of memory access and associated context information to a requesting guest;
wherein the virtual machine comprises a virtual motherboard including a virtual CPU and memory by the VAL.
26. The method of claim 25 , further comprising one or more of:
implementing at least one routine and/or component to prohibit the guest operating systems from tampering with, corrupting, and/or bypassing the detection mechanism(s); and
executing the detection mechanism(s) while preventing interference and/or bypassing, corrupting, tampering by the plurality of guest operating systems.
27. The method of claim 25 , wherein:
the plurality of guest operating system virtual machine protection domains includes corresponding guest operating systems; and
wherein isolating the loss of security in one of the guest operating system virtual machine protection domains to the one lost security domain such that security is not broken in all the domains.
28. The method of claim 25 , wherein:
moving virtualization processing to the virtual hardware platforms within each guest operating system protection domain so that substantially all analysis and security testing is performed within each guest operating system protection domain such that the separation kernel hypervisor is of reduced size/complexity.
29. The method of claim 25 , wherein:
detecting in each of the domains their own malicious code as a function of the isolated domains; or wherein viewing the virtual hardware platform within each domain as separate hardware by a guest such that bypass is prevented.
30. The method of claim 25 , wherein the detection mechanism(s) include subcomponents and/or subroutines configured for monitoring of guest operating system memory access.
31. The method of claim 25 , wherein the detection mechanism(s) include subcomponents and/or subroutines configured for monitoring actions of the guest operating system including observation, detection, and/or tracking of code, data, execution flow, and/or resource utilization at runtime.
32. The method of claim 25 , further comprising:
monitoring, via at least one detection mechanism, for suspect code;
ascertaining where code is operating, hiding, halted, stalled, infinitely looping, making no progress beyond intended execution, stored, once-active, extinct, not present but having performed suspect and/or malicious action, and/or in a position to maliciously affect a resource under control of a hypervisor guest.
33. The method of claim 25 , further comprising:
executing one or more detection mechanism(s) while preventing interference and/or corruption/tampering/bypassing by the plurality of guest operating system virtual machine protection domains.
34. The method of claim 25 , wherein the detection mechanism(s) include subcomponents and/or subroutines configured for monitoring actions of the guest operating system including mitigation, prevention, and/or modification of code, data, execution flow, and/or resource utilization at runtime, as detected by the detection mechanism.
35. The method of claim 25 , wherein the detection mechanism(s) include subcomponents and/or subroutines configured for monitoring actions of the guest operating system including reporting upon of suspect code, data, execution flow, and/or resource utilization at runtime, as detected by the detection mechanism.
36. The method of claim 25 , further comprising:
enforcing policy for activities monitored by the detection mechanism(s) within the guest operating system virtual machine protection domain.
37. The method of claim 25 , wherein the virtualization assistance layer virtualizes portions of the hardware platform resources including a virtual CPU/ABI, a virtual chipset ABI, a set of virtual devices, a set of physical devices, and firmware exported to the corresponding guest operating system.
38. The method of claim 25 , further comprising:
polling memory assigned to the guest operating system by at least one of the detection mechanisms.
39. The method of claim 25 , further comprising:
monitoring patterns of guest operating system memory access by at least one of the detection mechanism based on a feedback mechanism.
40. The method of claim 25 , wherein guest operating system memory includes any of an interrupt descriptor table, global descriptor table and local descriptor table and an application hosted by the guest operating system.
41. The method of claim 32 wherein the at least one detection mechanism includes a malicious code detection mechanism and/or a malware detection mechanisms.