Microsoft Technology Licensing, LLC

Joy Ganguly

Eric P Traut

Scott Field

Rene Antonio Vega

David N Cutler

Forrest Curtis Foltz

Brandon S Baker

Suyash Sinha

This document describes tools capable of enabling a protection agent to determine, from memory inaccessible from an operating-system privilege mode, whether one or more resources of an operating system have been modified. In some instances, these tools may enable the protection agent to reside within a virtual machine monitor. In other instances, the tools may enable the protection agent to reside within a distinct virtual partition provided by the virtual machine monitor. By operating outside of the operating-system privilege mode, the protection agent may be less vulnerable to attacks by entities operating within the operating-system privilege mode.

Protecting operating-system resources

Various embodiments of the present invention are directed to a multi-level virtualizer that is designed to remove much of the intercept-related functionality from the base-level virtualizer (that exists outside of each partition) and, instead, incorporate much of this functionality directly into each partition. For several of the embodiments, certain intercept handling functions are performed by an 'external monitor' that runs within a partition and responds to specific intercept events, and the base-level virtualizer installs these external monitors within each partition and thereafter manages the external monitors for both single-partition and cross-partition intercept events. This distributed approach to intercept handling allows for a much less complex virtualizer and moves the intercept functionality up into each partition where each external monitor uses the resources of the corresponding guest operating system in that partition to resolve the intercept event.

Systems and methods for multi-level intercept processing in a virtual machine environment

Growing community of inventors

Redmond, WA, United States of America

Joy Ganguly