Safeguarded, Hypervisor-based Installation of Highly Trusted Security Updates (SHIH-TSU)

ABSTRACT: This effort will establish the capability to apply security patches to virtual machines (VMs) running operating systems that are misconfigured or malfunctioning. Application of the patches will be minimally dependent on the VM host, protected from interference by other processes, and require no connection to the internet. Patching VMs from the perspective of a hypervisor is difficult due to a number of reasons such as the semantic gap between the guest and the hypervisor, the ability of malware to interfere with the installation and processing of updates, and the undocumented nature of OS-specific mechanisms for the processing of updates. As such, there are currently no tools designed to initiate the application of security patches from the hypervisor itself. The approach taken by AIS will be to leverage the proprietary introspective hypervisor known as IntroVirt, along with its"wintrovirt"library built specifically to bridge the semantic gap between the hypervisor and running guests. This approach will succeed in part because a number of the anticipated challenges have already been investigated and shown to be both possible and effective using IntroVirt. BENEFIT: The capability to automatically apply security patches from a hypervisor is greatly needed in the burgeoning world of cloud computing where current methods of keeping a large system base up-to-date and free from the effects of malware are struggling to keep pace with growth of the industry. AIS will work with an advocate in cloud industry to ensure that the developed approach is compatible with current and future cloud implementations and encompassing infrastructure.