Back to results
US 10,372,472 B2Granted
System, method, and computer program product for conditionally preventing use of hardware virtualization
AssigneeMcAfee, Inc.
InventorsPeter Blaimschein, Thomas C. H. Steeiner, Gregory William Dalcher, John Douglas Teddy
Life of this patent
Estimating the term…
Abstract
A system, method, and computer program product are provided for conditionally preventing use of hardware virtualization. In use, an attempt to use hardware virtualization is identified. Further, the use of the hardware virtualization is conditionally prevented.
Claims20
A non-transitory machine readable medium, on which are stored instructions that when executed cause a computer having hardware virtualization capability to:
- register a virtual machine guard of a virtualization layer with a hardware virtualization provider while an operating system is running;
- move the running operating system into a virtual machine by the virtual machine guard;
- recognize, by the virtual machine guard, an attempt to use hardware virtualization by the operating system or an application running under the operating system;
- determine an identifier associated with a source of the attempt;
- disallow the attempt as being associated with malware responsive to a determination that the identifier is on a list of predetermined identifiers;
- allow the attempt responsive to a determination that the identifier is not on the list of predetermined identifiers;
- and
- log the attempt to use hardware virtualization,
- wherein, subsequent to logging the attempt, the virtual machine guard continues operation to recognize additional attempts to use hardware virtualization.
6 more elements
A programmable device having a hardware virtualization capability, comprising:
- one or more processors having a hardware virtualization capability;
- and
- a memory, coupled to the one or more processors, on which are stored instructions that when executed cause some of the one or more processors to:
- register a virtual machine guard of a virtualization layer with a hardware virtualization provider while an operating system is running;
- move the running operating system into a virtual machine by the virtual machine guard;
- recognize, by the virtual machine guard, an attempt to use hardware virtualization by the operating system or an application running under the operating system;
- determine an identifier associated with a source of the attempt;
- disallow the attempt as being associated with malware, responsive to the identifier being on a list of predetermined identifiers;
- allow the attempt, responsive to the identifier not being on the list of predetermined identifiers;
- and
- log the attempt to use hardware virtualization,
- wherein, subsequent to logging the attempt, the virtual machine guard continues operation to recognize additional attempts to use hardware virtualization.
9 more elements
A method of preventing operation of malware comprising:
- registering a virtual machine guard of a virtualization layer with a hardware virtualization provider while an operating system is running;
- moving the running operating system into a virtual machine by the virtual machine guard;
- recognizing, by the virtual machine guard, an attempt to use hardware virtualization by the operating system or an application running under the operating system;
- determining an identifier associated with a source of the attempt;
- disallowing the attempt as being associated with malware, responsive to determining the identifier is on a list of predetermined identifiers;
- allowing the attempt responsive to determining the identifier is not on the list of predetermined identifiers;
- and
- logging the attempt to use hardware virtualization,
- wherein, subsequent to logging the attempt, the virtual machine guard continues operation to recognize additional attempts to use hardware virtualization.
6 more elements
Dependencies are inferred from the claim text.