Name
Abstract | ||
|---|---|---|
The advent of cloud computing and inexpensive multi-core desktop architectures has led to the widespread adoption of virtualization technologies. Furthermore, security researchers embraced virtual machine monitors (VMMs) as a new mechanism to guarantee deep isolation of untrusted software components, which, coupled with their popularity, promoted VMMs as a prime target for exploitation. In this paper, we present HyperCheck, a hardware-assisted tampering detection framework designed to protect the integrity of hypervisors and operating systems. Our approach leverages System Management Mode (SMM), a CPU mode in ×86 architecture, to transparently and securely acquire and transmit the full state of a protected machine to a remote server. We have implement two prototypes based on our framework design: HyperCheck-I and HyperCheck-II, that vary in their security assumptions and OS code dependence. In our experiments, we are able to identify rootkits that target the integrity of both hypervisors and operating systems. We show that HyperCheck can defend against attacks that attempt to evade our system. In terms of performance, we measured that HyperCheck can communicate the entire static code of Xen hypervisor and CPU register states in less than 90 million CPU cycles, or 90 ms on a 1 GHz CPU. |
Year | DOI | Venue |
|---|---|---|
2014 | 10.1109/TDSC.2013.53 | IEEE Trans. Dependable Sec. Comput. |
Keywords | Field | DocType |
hardware-assisted integrity monitor,kernel,operating systems,untrusted software components,coreboot,cpu register,xen hypervisor,vmm,os code dependence,multicore desktop architectures,virtual machine monitors,virtual machines,hardware-assisted tampering detection framework,hypercheck-i,hypervisor,virtualisation,security assumptions,hypercheck-ii,cloud computing,system management mode,security of data,smm,security,hardware,registers | Virtualization,Virtual machine,Storage hypervisor,Computer science,Rootkit,Hypervisor,Real-time computing,CPU modes,Operating system,Cloud computing,System Management Mode,Embedded system | Journal |
Volume | Issue | ISSN |
11 | 4 | 1545-5971 |
Citations | PageRank | References |
16 | 0.75 | 0 |
Authors | ||
4 | ||
Name | Order | Citations | PageRank |
|---|---|---|---|
| Fengwei Zhang | 1 | 157 | 19.63 |
| Jiang Wang | 2 | 113 | 6.95 |
| Kun Sun | 3 | 142 | 12.80 |
| Angelos Stavrou | 4 | 1288 | 98.69 |