Systems and methods involving features of hardware virtualization, hypervisor, APIs of interest, and/or other features
Systems, methods, computer readable media and articles of manufacture consistent with innovations herein are directed to computer virtualization, computer security and/or memory access. According to some illustrative implementations, innovations herein may utilize and/or involve a separation kernel hypervisor which may include the use of a guest operating system virtual machine protection domain, a virtualization assistance layer, and/or a detection mechanism (which may be proximate in temporal and/or spatial locality to malicious code, but isolated from it), inter alia, for detection and/or notification of, and action by a monitoring guest upon access by a monitored guest to predetermined physical memory locations.
1. A method for processing information securely, the method comprising:
partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains each including a virtual machine; and
isolating the domains in time and/or space from each other;
hosting a mechanism to unmap specified pages on demand from another guest;
processing an unmapped page exception taken by the virtual machine;
mapping an unmapped page previously processed by the virtual machine;
sending a notification of memory access and associated context information to a requesting guest, wherein the virtual machine comprises a virtual motherboard including a virtual CPU and memory by a virtualized assistance layer (VAL);
allowing the virtual machine to execute a single instruction;
returning control to the VAL;
mapping the unmapped page as inaccessible again; and
returning control to the virtual machine.
2. The method of claim 1 , further comprising:
sending a notification of memory access and a specification to a requesting guest.
3. The method of claim 2 , further comprising:
configuring a memory management unit such that software in the virtual machine cannot undo the mapping.
4. The method of claim 2 , wherein:
the plurality of guest operating system virtual machine protection domains includes corresponding guest operating systems; and
wherein isolating the loss of security in one of the guest operating system virtual machine protection domains to the one lost security domain such that security is not broken in all the domains.
5. The method of claim 2 , further comprising one or more of:
implementing at least one routine and/or component to prohibit the guest operating systems from tampering with, corrupting, and/or bypassing the mechanism; and
executing the mechanism while preventing interference and/or bypass, corruption, and/or tampering by the plurality of guest operating systems.
6. The method of claim 2 , further comprising:
detecting in each of the domains their own malicious code as a function of the isolated domains; or wherein viewing the virtual hardware platform within each domain as separate hardware by a guest such that bypass is prevented.
7. The method of claim 2 , further comprising:
moving virtualization processing to the virtual hardware platforms within each guest operating system protection domain so that substantially all analysis and security testing is performed within each guest operating system protection domain such that the separation kernel hypervisor is of reduced size and/or complexity.
8. The method of claim 2 , further comprising:
detecting in each of the domains their own malicious code as a function of the isolated domains; or wherein viewing the virtual hardware platform within each domain as separate hardware by a guest such that bypass is prevented.
9. The method of claim 2 , wherein the mechanism includes subcomponents and/or subroutines configured for monitoring of guest operating system memory access.
10. The method of claim 2 , wherein the mechanism includes subcomponents and/or subroutines configured for monitoring actions of the guest operating system including observation, detection, and/or tracking of code, data, execution flow, and/or resource utilization at runtime.
11. The method of claim 2 , further comprising:
monitoring, via the mechanism, for suspect code;
ascertaining where code is at least one of operating, hiding, halted, stalled, infinitely looping, making no progress beyond intended execution, stored, once-active, extinct/not present but having performed suspect and/or malicious action, in a position to maliciously affect a resource under control of a hypervisor guest.
12. The method of claim 2 , further comprising:
executing the mechanism while preventing interference, corruption, tampering and/or bypassing by the plurality of guest operating system virtual machine protection domains.
13. The method of claim 2 , wherein the mechanism includes subcomponents and/or subroutines configured for monitoring actions of the guest operating system including mitigation, prevention, and/or modification of code, data, execution flow, and/or resource utilization at runtime, as detected by the mechanism.
14. The method of claim 2 , wherein the mechanism includes subcomponents and/or subroutines configured for monitoring actions of the guest operating system including reporting upon of suspect code, data, execution flow, and/or resource utilization at runtime, as detected by the mechanism.
15. The method of claim 2 , further comprising:
enforcing policy for activities monitored by the mechanism within the guest operating system virtual machine protection domain.
16. The method of claim 2 , wherein the virtualization assistance layer virtualizes portions of the hardware platform resources including a virtual CPU/ABI, a virtual chipset ABI, a set of virtual devices, a set of physical devices, and firmware exported to the corresponding guest operating system.
17. The method of claim 2 , further comprising:
trapping access to memory assigned to a guest operating system; and
passing the trapped memory access to the mechanism via the virtualization assistance layer.
18. A method for processing information securely, the method comprising:
partitioning hardware platform resources via a separation kernel hypervisor into a plurality of guest operating system virtual machine protection domains each including a virtual machine;
isolating the domains in time and/or space from each other;
sharing a list of memory locations of an authorized guest to another guest;
hosting a mechanism to control access to specified locations and/or pages on demand from the another guest; and
processing an attempt to gain access to at least one of the specified locations and/or pages.
19. The method of claim 18 , further comprising:
providing a virtualization assistance layer (VAL) including a virtual representation of the hardware platform in each of the guest operating system virtual machine protection domains such that the VAL is not directly accessible by the authorized guest.
20. The method of claim 18 , further comprising:
performing processing including sending a notification of attempted access and associated context information related to the attempt.
21. The method of claim 18 , further comprising:
providing a list of memory locations of the authorized guest to the another guest;
providing a message of the authorized guest to the another guest;
hosting a mechanism to unmap specified pages on demand from another guest;
processing an unmapped page exception taken by the virtual machine;
mapping an unmapped page of the exception that was processed by the virtual machine; and
sending a notification of memory access and associated context information to a requesting guest;
wherein the virtual machine comprises a virtual motherboard including a virtual CPU and memory.
22. The method of claim 18 further comprising:
triggering entry into the separation kernel hypervisor upon execution of code involving an access attempt to an application programming interface (API) in a suspect guest operating system;
transitioning execution of the access attempt from the separation kernel hypervisor to the dedicated Virtualization assistance layer in a manner isolated from the suspect guest operating system;
transitioning execution of the access attempt from the dedicated Virtualization assistance layer to a detection mechanism;
analyzing by the detection mechanism behavior of the suspect guest operating system and determining a policy decision;
passing the policy decision and transitioning execution of the access attempt from the detection mechanism to the dedicated Virtualization assistance layer; and
passing the policy decision and transitioning execution of the access attempt from the dedicated Virtualization assistance layer to the separation kernel hypervisor. wherein the separation kernel hypervisor performs enforcement or executes an action based on the policy decision.
23. The method of claim 18 , further comprising: allowing the Virtual machine to execute a single instruction; and returning control to a Virtualization assistance layer (VAL) within a protection domain associated with the Virtual machine.
24. The method of claim 18 , further comprising:
detecting in each of the domains their own malicious code as a function of isolated domains; and
enabling viewing the virtual hardware platform within each domain as separate hardware by a guest such that bypass is prevented.
25. The method of claim 18 , further comprising:
executing one or more detection mechanisms that include subcomponents and/or subroutines configured for monitoring actions of the guest operating system including observation, detection, and/ or tracking of code, data, execution flow, and/ or resource utilization at runtime.
26. The method of claim 25 , further comprising:
monitoring for suspect code via the one or more detection mechanisms; and
ascertaining where code is at least one of operating, hiding, halted, stalled, infinitely looping, making no progress beyond intended execution, stored, once-active, extinct and/or not present but having performed suspect and/or malicious action, and/or in a position to maliciously affect a resource under control of a hypervisor guest.
27. The method of claim 18 , further comprising:
trapping access to memory assigned to a guest operating system; and
passing the trapped memory access to the detection mechanism via a virtualization assistance layer.
28. The method of claim 18 , further comprising:
hosting one or more detection mechanisms, each which may be different from each other, that execute Within one or more of the plurality of guest operating system Virtual machine protection domains via the separation kernel hypervisor, wherein the separation kernel hypervisor is configured to host the one or more detection mechanisms isolated from malicious code though having high temporal and spatial locality to the malicious code.