Citation Context

...ing security and functional properties including secrecy of security sensitive application code and data [7], trusted user and application interfaces [2], [4], [13], application integrity and privacy =-=[3]-=-, [5], [10], [11], [17], debugging support [8], malware analysis, detection and runtime monitoring [6], [9], [14]–[16] and trustworthy resource accounting [1]. A majority of these hypervisor-based sol...

Citation Context

...ted hypervisors. In particular, they do not address host-guest mode switches and hardware-based memory virtualization (e.g., EPT [19]), which are unique and essential to hosted hypervisors. HyperLock =-=[51]-=- similarly creates a separate address space in host OS kernel so that the execution of KVM as a loadable module can be isolated. However, it still runs in privileged mode and requires additional compl...

Citation Context

...number of virtual machine escape attacks [9], [10], [11] and hypervisor rootkits [12] are widely deployed. Security researchers have noticed this problem and have begun to improve hypervisor security =-=[13]-=-, [14], [15]. The increase of vulnerabilities and the observed attack trends have spurred research towards reducing the Trusted Code Base (TCB) of current commercial hypervisors [16]. Others developed...

Citation Context

...he shared region as read-only inside the process’s address space, causing the management stack kernel to take a fault if the process writes to the region. This is similar to how the HyperLock project =-=[19]-=- prevents the KVM hypervisor from writing into any domain other than its own or how the SecVisor project [18] prevents the kernel from executing user pages. For propagating taint, when a communication...

Citation Context

...han shadow paging [42]. Threat model: in this paper, we assume a trusted booting protocol, such as tboot [41], is used to securely load the hypervisor, which in turn loads the guest OS and initializes SecPod. The guest kernel is benign but contains exploitable vulnerabilities. After boot, we assume a powerful attacker exists that can change arbitrary memory of the kernel by exploiting some vulnerabilities. Moreover, we consider the hypervisor to be trusted. This can be guaranteed by recent advances in the hypervisor integrity through formal verification and integrity protection and monitoring [25, 29, 40, 44, 46]. 3 System Design 3.1 System overview SecPod aims at providing a trusted execution environment for virtualization-based security tools. Figure 3 gives an overview of SecPod with the two key techniques: paging delegation and execution trapping. In this architecture, security tools run in a dedicated secure space defined by the SecPod page table, while the kernel runs in the normal space defined by the kernel page table. An entry gate and an exit gate are responsible for switching these two spaces. This is essentially a page table based isolation [35, 39, 46]. To switch the space, the entry or e...

Citation Context

...the support of self-modifying code or JIT (those features probably are not as useful for a kernel-level sandbox anyway). We can design a verifier to prove that a binary is safe to run in the kernel sandbox [46]. Second, the domain switch mechanism needs to be changed as well. ARMlock depends on the kernel to switch domains. The kernel is always accessible in ARMlock. This is not the case for a kernel-level sandbox since only part of the kernel is accessible at any time. We need to design a software-based domain switch mechanism, potentially with the help of some form of control-flow integrity [44, 46]. Third, the interrupt handling has to be adapted so that interrupt handlers are accessible in both the main kernel and the sandbox. In addition, the verifier should be applied to those handlers to prevent them from being misused. Interrupts happened in the sandbox are rerouted to the main kernel for processing. Close-sourced OS support: our prototype targets Linux, arguably the most popular OS for the ARM processors. However, the design of ARMlock is neutral to the underlying OS. Particularly, it might be possible to adapt ARMlock to the Windows RT operating system. Close-sourced OSes pose ex...

Citation Context

...nsional) paging ∗ 1. INTRODUCTION Recentyearshaveyieldedsignificantresearchonhypervisorbased architectures for security [9,15,17,24–26,29,30,32,34, 37,38,40,41,45,46]. A majority of these hypervisors =-=[17,24, 25,29,37,38,40,41,46]-=- are designed and written from scratch with the primary goal of achieving a low Trusted Computing Base (TCB) while providing a specific security property. Other research efforts leverage existing comm...

Citation Context

...tacker take full control of the system. Moreover, the data leakage to the user space from the kernel space is avoided as the calls in DeHype are executed as a user space function call. The authors in =-=[111]-=- adopted a similar approach to reduce the attack surface by providing an isolated runtime environment for hypervisor execution. The proposed scheme called HyperLock provides an isolated address space ...

Citation Context

...ing security and functional properties including secrecy of security sensitive application code and data [7], trusted user and application interfaces [2], [4], [13], application integrity and privacy =-=[3]-=-, [5], [10], [11], [17], debugging support [8], malware analysis, detection and runtime monitoring [6], [9], [14]–[16] and trustworthy resource accounting [1]. A majority of these hypervisor-based sol...