Secure virtualization system software
Systems and methods for protecting a virtualization environment against malware. The methods involve intercepting an event in a kernel mode of the virtualization environment, suspending execution of the event, and transmitting the event to a user mode security module that determines whether the event should be blocked, allowed, or redirected. Events may be intercepted from any level of the virtualization environment, including an interrupt request table, device driver, OS object manager, OS service dispatch table, Portable Execution (P/E) import/export table, or binary code, among others. In one embodiment, an event may trigger a chain of related events, such that interception of an event without first intercepting an expected antecedent event is one indication of malware. The method also involves securing a virtual storage device against unauthorized access and providing for secure communication between guest OS and virtualization environment security modules.
1. A method implemented on a computing device for securing a virtualization environment against malware, comprising:
suspending an event in a kernel mode of a first guest operating system running on top of a first virtual machine created by virtualization platform software;
making the event available to a user mode security module of the first guest operating system;
performing, by the user mode security module, a security analysis of the event;
performing the following operations if the security analysis indicates execution of the event is not secure,
blocking execution of the event,
communicating information specifying an existence of a malicious event from the first guest operating system to a security component of the virtualization environment,
sending a communication alerting of the existence of the malicious event from the virtualization environment to a second guest operating system running on top of a second virtual machine created by the virtualization platform software, where the first and second virtual machines are separate and distinct virtual machines that are concurrently existing within the virtualization environment prior to, during, and subsequent to the time the security analysis is performed, and
terminating execution of the first guest operating system; and
resuming execution of the event if the security analysis indicates execution of the event is secure.
2. The method according to claim 1 , wherein the event is one of the group consisting of an interrupt request, a function call, and an operating system message.
3. The method according to claim 1 , wherein the method secures a non-virtualization operating system against malware.
4. The method according to claim 1 , wherein the event is intercepted from one of the group consisting of an interrupt request table, a device driver, an operating system (OS) object manager, an OS service dispatch table, a Portable Execution (P/E) export table, and an executable instruction.
5. The method according to claim 1 , wherein the event originated in a hardware device.
6. The method according to claim 1 , further comprising receiving the event directly from a source module.
7. The method according to claim 1 , wherein the event is selected from the group consisting of a kernel mode event and a user mode event.
8. The method according to claim 1 , wherein a plurality of user mode security modules receive the event, and each of the plurality of user mode security modules are capable of determining whether execution of the event is secure.
9. The method according to claim 1 , wherein the user mode security module redirects the event to another module for additional processing before allowing the suspended event to be resumed.
10. The method according to claim 1 , wherein the security module modifies the event before allowing the suspended event to be resumed.
11. The method according to claim 1 , wherein the security analysis is based in part on determining whether malware initiated the event.
12. The method according to claim 1 , wherein the event is one of a series of related events, and wherein the security analysis is based in part on determining whether the event was preceded by at least one of the series of events.
13. The method according to claim 1 , further comprising detecting code injected into the virtualization environment by:
scanning for a portion of memory that is inaccessible to the virtualization environment;
identifying a file on a storage device associated with the portion of inaccessible memory; and
determining when the file on the storage device associated with the portion of inaccessible memory includes malware.
14. A computer system for securing a virtual storage device stored on a physical storage device, comprising:
a computer readable medium having a plurality of instructions stored thereon; and
at least one processing device communicatively coupled to the computer readable medium and configured to execute the plurality of instructions that cause the computer system to perform actions comprising:
receiving an access event for the physical storage device;
suspending the physical storage device access event in a first guest operating system running on top of a first virtual machine created by virtualization platform software;
making the physical storage device access event available to a user mode security module of the first guest operating system;
performing, by the user mode security module, a security analysis to determine whether to block or allow the physical storage device access event, the security analysis based in part on whether the physical storage device access event originated from a virtual storage device driver in the first guest operating system;
performing the following operations if it is determined that the physical storage device access event is to be blocked,
blocking execution of the physical storage device access event,
communicating information specifying an existence of a malicious event from the first guest operating system to a security component of a virtualization environment,
sending a communication alerting of the existence of the malicious event from the virtualization environment to a second guest operating system running on top of a second virtual machine created by the virtualization platform software, where the first and second virtual machines are separate and distinct virtual machines that are concurrently existing within the virtualization environment prior to, during, and subsequent to the time the security analysis is performed, and
terminating execution of the first guest operating system; and
resuming execution of the physical storage device access event if the indication is to allow the physical storage device access event.
15. The computer system according to claim 14 , wherein the user mode security module redirects the physical storage device access event to an encryption module when the event includes a write event, and wherein the security module redirects the physical storage device access event to a decryption module when the event includes a read event.
16. The computer system according to claim 14 , wherein the user mode security module is executed in kernel mode.