Micro-virtualization architecture for threat-aware module deployment in a node of a network environment

A method comprising:

• storing a process, a single instance of an operating system kernel, a virtual machine monitor (VMM) and a virtualization module in a memory coupled to a central processing unit (CPU) of a node in a computer network;
• executing the virtualization module at a highest privilege level of the CPU to control access permissions to a plurality of kernel resources accessible by the process;
• executing the VMM as a pass-through module at a highest privilege level of the virtualization module to expose the kernel resources to the operating system kernel;
• executing the operating system kernel at a privilege level lower than the highest privilege level of the virtualization module;
• instantiating a virtual machine containing the operating system kernel;
• instantiating a micro-virtual machine restricted to containing the process;
• and
• controlling access to the kernel resources among the virtual machine and the micro-virtual machine.

A system comprising:

• a central processing unit (CPU) adapted to execute a plurality of user mode processes, a single instance of an operating system kernel, a type 0 virtual machine monitor (VMM 0) and a virtualization module;
• a memory configured to store the user mode processes, the operating system kernel, the VMM 0 and the virtualization module;
• the virtualization module disposed beneath the operating system kernel and configured to communicate with the VMM 0 over a privileged interface, the virtualization module further configured to execute at a highest privilege level of the CPU to control access permissions to a plurality of kernel resources accessible by the user mode processes;
• the VMM 0 including instrumentation logic configured to analyze a system call issued by a first process to invoke services of the operating system kernel that include accesses to the kernel resources, the VMM 0 configured as a pass-through module executing at a highest privilege level of the virtualization module to expose the kernel resources to the operating system kernel, the VMM 0 configured to instantiate a virtual machine containing the operating system kernel, the VMM 0 further configured to instantiate a plurality of micro-virtual machines, each micro-virtual machine restricted to containing one of the processes, wherein access to the kernel resources is controlled by the VMM 0 among the virtual machine and the micro-virtual machines;
• and
• the operating system kernel including an operating system specific VMM 0 extension adapted to communicate with the VMM 0, the operating system kernel configured to execute at a privilege level lower than the highest privilege level of the virtualization module.

A non-transitory computer readable media containing instructions for execution on a processor for a method comprising:

• storing a plurality of processes, a single instance of an operating system kernel, a virtual machine monitor (VMM) and a virtualization module in a memory coupled to a central processing unit (CPU) of a node in a computer network;
• executing the virtualization module at a highest privilege level of the CPU to control access permissions to a plurality of kernel resources accessible by the processes;
• executing the VMM as a pass-through module at a highest privilege level of the virtualization module to expose the kernel resources to the operating system kernel;
• executing the operating system kernel at a privilege level lower than the highest privilege level of the virtualization module;
• instantiating a virtual machine containing the operating system kernel;
• instantiating a plurality of micro-virtual machines, each micro-virtual machine restricted to containing one of the processes;
• and
• controlling access to the kernel resources among the virtual machine and the micro-virtual machines.