KR20240080245A - System for Protecting Virtual Machine Kernel Runtime in Cloud Platform - Google Patents

Abstract

A virtual machine kernel runtime protection system in a cloud platform environment is disclosed. The virtual machine kernel runtime protection system uses VMI (Virtual Machine Introspection) to verify the integrity of the virtual machine kernel runtime in a cloud environment, a process of analyzing memory address information of a virtual machine running the Linux kernel; And the process of verifying the kernel modulation integrity of the virtual machine can be processed using the memory address information.

Description

System for Protecting Virtual Machine Kernel Runtime in Cloud Platform}

The explanation below is about technology for protecting virtual machine kernel runtime in a cloud platform environment.

As virtualization technology, the underlying technology of cloud computing, develops, cloud computing technology is also developing, and user convenience is increasing due to advantages such as continuity and efficiency of cloud computing.

However, from a security perspective, solutions to protect virtual machines from attacks related to the kernel area cannot be applied to the cloud environment as is. If the existing kernel runtime protection software is run as an agent installed inside each virtual machine, resource efficiency is reduced in a cloud environment. Additionally, some kernel protection solutions have the same privileges as kernel attack programs, and if an attack is successful, these solutions are stopped or interrupted, making normal security operations impossible.

Therefore, a technology is needed to detect modification of the virtual machine kernel from outside the virtual machine. VMI (Virtual Machine Introspection) is a method that allows the host to transparently observe the runtime state of a virtual machine, and can collect all memory data and vCPU registers allocated to the virtual machine in binary form.

In order to protect the kernel of a virtual machine in a cloud platform environment, there are various requirements to use a VMI-based method that protects the host, rather than an agent method installed within the virtual machine. First, the integrity of the kernel's protection area needs to be verified. Second, it must be possible to detect kernel modification even if the kernel image used by the virtual machine has already been modified. Lastly, virtual machines experience performance degradation due to real-time VMI, which must be minimized.

We provide technical ideas that can accurately and efficiently detect kernel modification of virtual machines running in a cloud platform environment using the VMI method.

A virtual machine kernel runtime protection system implemented in a computer system, comprising at least one processor configured to execute computer-readable instructions included in a memory, wherein the at least one processor uses Virtual Machine Introspection (VMI) Performing virtual machine kernel runtime integrity verification in a cloud environment, a process of analyzing memory address information of a virtual machine running the Linux kernel; and a virtual machine kernel runtime protection system that processes the process of verifying the kernel tampering integrity of the virtual machine using the memory address information.

According to one aspect, the at least one processor may obtain a memory address of a kernel protection area from the kernel area memory of a target virtual machine running on a Linux operating system.

According to another aspect, the at least one processor may use a reference hash value to check whether the memory value of the kernel protection area of the virtual machine has been tampered with.

According to another aspect, when booting of the virtual machine is completed, the at least one processor dumps data in the physical memory area according to the memory address information and uses a hash value for the dumped memory data as an integrity verification standard. You can check whether the kernel has been tampered with by comparing it with the hash value.

According to another aspect, the at least one processor analyzes address information about the kernel protection area using section information included in vmlinux, which is a kernel code, and maps the analyzed address to the kernel space of the guest virtual address. Then, the guest virtual address can be translated into a guest physical address, the guest physical address can be translated into a host physical address through EPT (Extended Page Tables), and physical memory data can be dumped from the host physical address.

According to another aspect, in the process of dumping virtual machine data, the at least one processor allocates a buffer to the host memory area through an in-memory method rather than a disk storage method and stores memory data in the buffer. can be copied.

According to another aspect, the at least one processor acquires a memory address of a kernel protection area of a virtual machine, reads physical memory data of the virtual machine verified with the acquired memory address, and stores the read memory data. Calculate the hash value and store it in the database, calculate the hash value for the memory data of the kernel protection area read from the target virtual machine, and calculate the hash value for the memory data of the target virtual machine and the hash value stored in the database. By comparing, it is possible to determine whether or not there has been tampering.

According to another aspect, the at least one processor may extract vmlinux, which is a kernel code, to obtain the memory address and size of a section, which is one of the kernel protection areas of the virtual machine.

According to another aspect, the at least one processor uses the Interrupt Descriptor Table (IDTR) of the Virtual Machine Control Structure (VMCS) to obtain the memory address and size of the interrupt descriptor table (IDT), which is one of the kernel protection areas of the virtual machine. You can read the value of Register).

According to another aspect, the at least one processor has <.text section>, which is an area where kernel code is stored, <.rodata section>, which is an area where read-only initialized data exists, and handles exceptions. Kernel tampering integrity verification can be performed on at least one kernel protection area among <__ex_table section>, which is an area where the table of functions is stored, and <IDT>, which is an area where the table of functions to handle interrupts is stored.

According to another aspect, in a virtual machine kernel runtime protection method performed on a computer system, the computer system includes at least one processor configured to execute computer-readable instructions included in a memory, and protecting the virtual machine kernel runtime. The method includes performing runtime integrity verification of a virtual machine kernel in a cloud environment using Virtual Machine Introspection (VMI), comprising: analyzing memory address information of a virtual machine running a Linux kernel by the at least one processor; and verifying, by the at least one processor, kernel modulation integrity of the virtual machine using the memory address information.

According to an embodiment of the present invention, it is possible to verify whether the kernel has been tampered with not only during runtime when the virtual machine operates with a hash database pre-configured before operation, but also even after the virtual machine is booted.

According to an embodiment of the present invention, by performing a check operation to protect the virtual machine kernel runtime on the host, it is possible to efficiently perform a protection operation against kernel tampering for multiple virtual machines in a cloud environment.

Figure 1 shows an example of an environment in which the virtual machine kernel runtime protection system is applied in one embodiment of the present invention.
Figure 2 illustrates an internal module of a virtual machine kernel runtime protection system in a cloud platform environment according to an embodiment of the present invention.
Figure 3 is a flowchart showing an example of a virtual machine kernel runtime protection process in a cloud platform environment according to an embodiment of the present invention.
Figure 4 shows an example of a process of dumping virtual machine physical data in a virtual machine kernel runtime protection system in a cloud platform environment according to an embodiment of the present invention.
Figure 5 shows an example of a kernel protection area subject to integrity verification of a virtual machine kernel runtime protection system in a cloud platform environment in an embodiment of the present invention.
Figure 6 is a block diagram showing an example of a computer system for implementing a virtual machine kernel runtime protection system in a cloud platform environment according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the attached drawings.

Embodiments of the present invention relate to technology for protecting virtual machine kernel runtime in a cloud platform environment.

Embodiments including those specifically disclosed in this specification are intended to protect the kernel of a virtual machine in a Linux environment running on the host's KVM (Kernel-based Virtual Machine)/QEMU (Quick Emulator), and are designed to protect the kernel from malicious attacks in the kernel area. It can protect against malicious code targeting the kernel area, which inserts and modifies code or changes the kernel data structure to direct it to malicious code.

Embodiments including those specifically disclosed in this specification can be used for rootkit detection, virtual machine monitoring, digital forensics, etc.

The virtual machine kernel runtime protection system according to embodiments of the present invention may be implemented by at least one computer device, and the virtual machine kernel runtime protection method according to embodiments of the present invention is included in the virtual machine kernel runtime protection system. It may be performed through at least one computer device. At this time, the computer program according to an embodiment of the present invention may be installed and driven in the computer device, and the computer device performs the virtual machine kernel runtime protection method according to the embodiments of the present invention under the control of the driven computer program. can do. The above-described computer program can be combined with a computer device and stored in a computer-readable recording medium to execute the virtual machine kernel runtime protection method on the computer.

Figure 1 shows an example of an environment in which the virtual machine kernel runtime protection system is applied in one embodiment of the present invention. Figure 1 shows an environment to which the virtual machine kernel runtime protection system according to an embodiment of the present invention is applied.

Referring to FIG. 1, the virtual machine kernel runtime protection system according to an embodiment of the present invention can be applied in an environment where a cloud platform 101 and an administrator 102 who manages cloud platform services exist.

In these embodiments, virtual machine kernel runtime integrity verification to respond to kernel attacks in a cloud environment can be performed through VMI at the host level.

Figure 2 illustrates an internal module of a virtual machine kernel runtime protection system in a cloud platform environment according to an embodiment of the present invention.

Referring to FIG. 2, the virtual machine kernel runtime protection system in a cloud platform environment according to an embodiment of the present invention includes a kernel protection area memory address analysis module 201 and a virtual machine memory dump module 202 operating at the host kernel level. It may include a hash database 203 and an integrity verification module 204 that operate at the host user level.

The kernel protection area memory address analysis module 201 is used to obtain address information (starting address, size) of the area subject to integrity verification in the kernel area memory of the virtual machine.

The virtual machine memory dump module 202 dumps data in the physical memory area corresponding to the address information obtained from the memory address analysis module 201.

The hash database 203 is used as a reference hash value to check whether the memory value of the kernel protection area of the target virtual machine has been tampered with.

The integrity verification module 204 is used to check whether the kernel has been tampered with by comparing hash values.

Figure 3 is a flowchart showing an example of a virtual machine kernel runtime protection process in a cloud platform environment according to an embodiment of the present invention.

The virtual machine kernel runtime protection system according to the present invention includes the steps of acquiring the memory address of the kernel protection area of the virtual machine, reading normal memory data from the virtual machine verified with the acquired memory address, and hashing the read memory data. Calculating the value and storing it in a hash database, reading memory data of the kernel protection area previously acquired in the target virtual machine, calculating a hash value for the memory data read from the target virtual machine, and storing it in the hash database. It may include a step of determining whether or not there has been tampering by comparing the stored hash value with the hash value of the memory data of the target virtual machine.

Referring to FIG. 3, first, the virtual machine kernel runtime protection system analyzes the virtual memory address information of the kernel protection area of the target virtual machine currently running on the cloud platform (Linux operating system) through the kernel protection area memory address analysis module 201 ( start address, size) (S301).

The virtual machine kernel runtime protection system dumps the physical memory data of the verified virtual machine based on the information analyzed in step S301 through the virtual machine memory dump module 202 (S302).

Next, the virtual machine kernel runtime protection system calculates the hash value for the dumped memory and creates a hash database that serves as the standard for integrity verification (S303).

When the booting of the target virtual machine is completed, the virtual machine kernel runtime protection system dumps the physical memory through the address information obtained in step S301 (S304).

The virtual machine kernel runtime protection system hashes the data dumped from the target virtual machine (S305).

Afterwards, the virtual machine kernel runtime protection system compares the hash database generated from the verified virtual machine and the hash value derived from the target virtual machine (S306).

If the hash values do not match, the virtual machine kernel runtime protection system determines that the kernel of the target virtual machine has been tampered with and executes security measures (e.g., stopping virtual machine execution, in-depth analysis, etc.) (S307).

If the hash value matches, the virtual machine kernel runtime protection system returns to step S304 and repeats the inspection of the above process during runtime when the virtual machine operates.

Figure 4 shows an example of a process of dumping virtual machine physical data in a virtual machine kernel runtime protection system in a cloud platform environment according to an embodiment of the present invention.

The virtual machine kernel runtime protection system according to the present invention may include the process of extracting the vmlinux file to obtain the memory address and size of the section that is the kernel protection area of the virtual machine. Here, the vmlinux file is an ELF (Excutable Linking Format) image file created when compiling the kernel and refers to uncompressed kernel code. By analyzing vmlinux, you can obtain symbol and data structure information.

Referring to Figure 4, the virtual machine kernel runtime protection system extracts the vmlinux file to analyze section information about the virtual machine kernel version (S401).

The virtual machine kernel runtime protection system calculates address information (starting address, size) for the protection area using the section information shown in vmlinux (S402).

The virtual machine kernel runtime protection system maps the address analyzed in step S402 to the kernel space of the guest virtual address (S403).

Next, the virtual machine kernel runtime protection system translates the guest virtual address into a guest physical address (S404).

The virtual machine kernel runtime protection system translates the guest physical address into the host physical address using EPT (Extended Page Tables) (S405). Here, EPT refers to hardware-assisted paging used to reduce the complexity of the shadow page table and the number of TLB (Translation lookaside buffer) flushes in a virtualization environment.

Finally, the virtual machine kernel runtime protection system allocates and copies a buffer to the host memory area to read memory from the translated memory area (S406).

In order to read memory data for the guest virtual machine corresponding to the address of the kernel protection area, VMI requests QEMU to read the virtual machine memory using the memory start address and size as parameters. QEMU translates the virtual address of the virtual machine into GVA (Guest Virtual Address), GPA (Guest Physical Address), and HPA (Host Physical Address) in order to dump the requested memory area. Then, the data in the corresponding area is dumped from the physical memory.

In the above process, the virtual machine kernel runtime protection system allocates a memory buffer to the host area through an in-memory method rather than storing it on disk during the process of dumping virtual machine data and stores it in the buffer, thereby protecting the memory. The time required for a dump, that is, the time required to read data, can be shortened.

Figure 5 shows an example of a kernel protection area subject to integrity verification of a virtual machine kernel runtime protection system in a cloud platform environment in an embodiment of the present invention.

Referring to FIG. 5, for example, <.text section> 501, one of the kernel protection areas subject to integrity verification, refers to an area where kernel code is stored. <.rodata section> (502) refers to an area where read-only initialized data exists. <__ex_table section>(503) refers to the area where the table of functions to handle exceptions when an exception occurs is stored. <IDT> (504) refers to the area where the table of functions to handle the interrupt when an interrupt occurs is stored. IDT (interrupt descriptor table) is a data structure used in the X86 architecture to implement an interrupt vector table. IDT is used by the processor to handle interrupts and exceptions. The IDT table stores the numbers of defined interrupts and addresses indicating execution codes. The virtual machine kernel runtime protection system may include the process of reading the value of the IDTR (Interrupt Descriptor Table Register) of the VMCS (Virtual Machine Control Structure) to obtain the memory address and size of the IDT, which is the kernel protection area of the virtual machine. .

The above-mentioned kernel areas 501 to 504 are areas that are common targets of code insertion and modification.

Figure 6 is a block diagram showing an example of a computer system according to an embodiment of the present invention. The virtual machine kernel runtime protection system in a cloud platform environment according to the present invention can be implemented by a computer system 600 configured as shown in FIG. 6.

As shown in FIG. 6, the computer system 600 is a component for executing the virtual machine kernel runtime protection method in a cloud platform environment according to embodiments of the present invention, and includes a memory 610, a processor 620, It may include a communication interface 630 and an input/output interface 640.

The memory 610 is a computer-readable recording medium and may include a non-permanent mass storage device such as random access memory (RAM), read only memory (ROM), and a disk drive. Here, non-perishable large-capacity recording devices such as ROM and disk drives may be included in the computer system 600 as a separate permanent storage device that is distinct from the memory 610. Additionally, an operating system and at least one program code may be stored in the memory 610. These software components may be loaded into the memory 610 from a computer-readable recording medium separate from the memory 610. Such separate computer-readable recording media may include computer-readable recording media such as floppy drives, disks, tapes, DVD/CD-ROM drives, and memory cards. In another embodiment, software components may be loaded into the memory 610 through the communication interface 630 rather than a computer-readable recording medium. For example, software components may be loaded into memory 610 of computer system 600 based on computer programs being installed by files received over network 660.

The processor 620 may be configured to process instructions of a computer program by performing basic arithmetic, logic, and input/output operations. Commands may be provided to the processor 620 by the memory 610 or the communication interface 630. For example, the processor 620 may be configured to execute received instructions according to program codes stored in a recording device such as memory 610.

The communication interface 630 may provide a function for the computer system 600 to communicate with other devices through the network 660. For example, a request, command, data, file, etc. generated by the processor 620 of the computer system 600 according to a program code stored in a recording device such as a memory 610 is transmitted to the network ( 660) and can be transmitted to other devices. Conversely, signals, commands, data, files, etc. from other devices may be received by the computer system 600 through the communication interface 630 of the computer system 600 via the network 660. Signals, commands, data, etc. received through the communication interface 630 may be transmitted to the processor 620 or memory 610, and files, etc. may be stored in a storage medium (as described above) that the computer system 600 may further include. It can be stored as a permanent storage device).

The communication method is not limited, and may include not only a communication method utilizing communication networks that the network 660 may include (e.g., mobile communication network, wired Internet, wireless Internet, and broadcasting network), but also short-distance wired/wireless communication between devices. there is. For example, the network 660 may be a personal area network (PAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN), or a broadband network (BBN). , may include one or more arbitrary networks such as the Internet. Additionally, the network 660 may include any one or more of network topologies including a bus network, star network, ring network, mesh network, star-bus network, tree or hierarchical network, etc. Not limited.

The input/output interface 640 may be a means for interfacing with the input/output device 650. For example, input devices may include devices such as a microphone, keyboard, camera, or mouse, and output devices may include devices such as displays and speakers. As another example, the input/output interface 640 may be a means for interfacing with a device that integrates input and output functions, such as a touch screen. The input/output device 650 may be configured as a single device with the computer system 600.

Additionally, in other embodiments, computer system 600 may include fewer or more components than those of FIG. 6 . However, there is no need to clearly show most prior art components. For example, the computer system 600 may be implemented to include at least some of the input/output devices 650 described above, or may further include other components such as a transceiver, various databases, etc.

As such, according to embodiments of the present invention, it is possible to verify whether the kernel has been tampered with not only during runtime when the virtual machine operates with a pre-configured hash database before the virtual machine operates, but also even after the virtual machine boots. And, according to embodiments of the present invention, as the host performs a check operation to protect the virtual machine kernel runtime, a protection operation against kernel tampering for multiple virtual machines in a cloud environment is performed. It can be performed efficiently.

The device described above may be implemented with hardware components, software components, and/or a combination of hardware components and software components. For example, the devices and components described in the embodiments include a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), and a programmable logic unit (PLU). It may be implemented using one or more general-purpose or special-purpose computers, such as a logic unit, microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. Additionally, a processing device may access, store, manipulate, process, and generate data in response to the execution of software. For ease of understanding, a single processing device may be described as being used; however, those skilled in the art will understand that a processing device includes multiple processing elements and/or multiple types of processing elements. It can be seen that it may include. For example, a processing device may include a plurality of processors or one processor and one controller. Additionally, other processing configurations, such as parallel processors, are possible.

Software may include a computer program, code, instructions, or a combination of one or more of these, which may configure a processing unit to operate as desired, or may be processed independently or collectively. You can command the device. The software and/or data may be embodied in any type of machine, component, physical device, computer storage medium or device for the purpose of being interpreted by or providing instructions or data to the processing device. there is. Software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer-readable medium. At this time, the medium may continuously store a computer-executable program, or temporarily store it for execution or download. In addition, the medium may be a variety of recording or storage means in the form of a single or several pieces of hardware combined. It is not limited to a medium directly connected to a computer system and may be distributed over a network. Examples of media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, And there may be something configured to store program instructions, including ROM, RAM, flash memory, etc. Additionally, examples of other media include recording or storage media managed by app stores that distribute applications, sites or servers that supply or distribute various other software, etc.

As described above, although the embodiments have been described with limited examples and drawings, various modifications and variations can be made by those skilled in the art from the above description. For example, the described techniques are performed in a different order than the described method, and/or components of the described system, structure, device, circuit, etc. are combined or combined in a different form than the described method, or other components are used. Alternatively, appropriate results may be achieved even if substituted or substituted by an equivalent.

Therefore, other implementations, other embodiments, and equivalents of the claims also fall within the scope of the claims described below.

Claims (15)

In a virtual machine kernel runtime protection system implemented as a computer system,
At least one processor configured to execute computer readable instructions contained in memory
Including,
The at least one processor,
It performs virtual machine kernel runtime integrity verification in a cloud environment using VMI (Virtual Machine Introspection).
The process of analyzing memory address information of a virtual machine running the Linux kernel; and
The process of verifying the kernel tampering integrity of a virtual machine using the memory address information
A virtual machine kernel runtime protection system that handles . According to paragraph 1,
The at least one processor,
Obtaining the memory address of the kernel protection area from the kernel area memory of the target virtual machine running on the Linux operating system.
A virtual machine kernel runtime protection system featuring. According to paragraph 1,
The at least one processor,
Checking whether the memory value of the kernel protection area of the virtual machine has been tampered with using the standard hash value.
A virtual machine kernel runtime protection system featuring. According to paragraph 1,
The at least one processor,
When booting of the virtual machine is complete, data in the physical memory area is dumped according to the memory address information,
Checking for kernel tampering by comparing the hash value of dumped memory data with the hash value that serves as an integrity verification standard.
A virtual machine kernel runtime protection system featuring. According to paragraph 1,
The at least one processor,
Address information about the kernel protection area is analyzed using section information included in the kernel code, vmlinux, and
Map the analyzed address to the kernel space of the guest virtual address,
Translating the guest virtual address into a guest physical address,
Translating the guest physical address into the host physical address through EPT (Extended Page Tables),
Dumping physical memory data from the host physical address
A virtual machine kernel runtime protection system featuring. According to paragraph 1,
The at least one processor,
In the process of dumping virtual machine data, allocating a buffer in the host memory area through the in-memory method rather than disk storage and copying the memory data to the buffer.
A virtual machine kernel runtime protection system featuring. According to paragraph 1,
The at least one processor,
Obtain the memory address of the virtual machine's kernel protection area,
Read the physical memory data of the virtual machine verified with the obtained memory address,
Calculating a hash value for the read memory data and storing it in a database,
Calculate the hash value for the memory data in the kernel protection area read from the target virtual machine,
Determining whether or not there has been tampering by comparing the hash value stored in the database with the hash value for the memory data of the target virtual machine.
A virtual machine kernel runtime protection system featuring. According to paragraph 1,
The at least one processor,
Extracting the kernel code, vmlinux, to obtain the memory address and size of a section, which is one of the virtual machine's kernel protection areas.
A virtual machine kernel runtime protection system featuring. According to paragraph 1,
The at least one processor,
Reading the value of IDTR (Interrupt Descriptor Table Register) of VMCS (Virtual Machine Control Structure) to obtain the memory address and size of IDT (interrupt descriptor table), one of the kernel protection areas of the virtual machine.
A virtual machine kernel runtime protection system featuring. According to paragraph 1,
The at least one processor,
<.text section>, which is the area where the kernel code is stored, <.rodata section>, which is the area where read-only initialized data exists, <__ex_table section>, which is the area where the table of functions to handle exceptions is stored, and Performing kernel tampering integrity verification targeting at least one kernel protection area among <IDT>, which is the area where the table of functions to handle interrupts is stored.
A virtual machine kernel runtime protection system featuring. In a method of protecting a virtual machine kernel runtime performed in a computer system,
The computer system includes at least one processor configured to execute computer-readable instructions contained in a memory,
The virtual machine kernel runtime protection method is,
Performs virtual machine kernel runtime integrity verification in a cloud environment using VMI (Virtual Machine Introspection).
Analyzing memory address information of a virtual machine running a Linux kernel by the at least one processor; and
Verifying kernel modulation integrity of the virtual machine using the memory address information by the at least one processor
A virtual machine kernel runtime protection method including. According to clause 11,
The analysis step is,
This is to obtain the memory address of the kernel protection area from the kernel area memory of the target virtual machine running on the Linux operating system.
extracting vmlinux, which is a kernel code, to obtain a memory address and size of a section, which is one of the kernel protection areas; and
Reading the value of the Interrupt Descriptor Table Register (IDTR) of the Virtual Machine Control Structure (VMCS) to obtain the memory address and size of the interrupt descriptor table (IDT), which is another one of the kernel protection areas.
A virtual machine kernel runtime protection method including. According to clause 11,
The verification step is,
When booting of the virtual machine is completed, dumping data in the physical memory area according to the memory address information; and
A step to check whether the kernel has been tampered with by comparing the hash value for the dumped memory with the hash value that serves as an integrity verification standard.
A virtual machine kernel runtime protection method including. According to clause 13,
The dumping step is,
Map address information about the kernel protection area of the virtual machine to the kernel space of the guest virtual address,
Translating the guest virtual address into a guest physical address,
Translating the guest physical address into the host physical address through EPT (Extended Page Tables),
Dumping physical memory data from the host physical address
A virtual machine kernel runtime protection method featuring. According to clause 13,
The dumping step is,
Allocating a buffer in the host memory area and copying memory data to that buffer using an in-memory method rather than a disk storage method.
A virtual machine kernel runtime protection method featuring.

Images