DMCA
A Non-Inclusive Memory Permissions Architecture for Protection Against Cross-Layer Attacks
Cached
Download Links
| Citations: | 5 - 2 self |
BibTeX
@MISC{Elwell_anon-inclusive,
author = {Jesse Elwell and Ryan Riley and Nael Abu-ghazaleh and Dmitry Ponomarev},
title = {A Non-Inclusive Memory Permissions Architecture for Protection Against Cross-Layer Attacks},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Protecting modern computer systems and complex software stacks against the growing range of possible attacks is be-coming increasingly difficult. The architecture of modern commodity systems allows attackers to subvert privileged sys-tem software often using a single exploit. Once the system is compromised, inclusive permissions used by current archi-tectures and operating systems easily allow a compromised high-privileged software layer to perform arbitrary malicious activities, even on behalf of other software layers. This paper presents a hardware-supported page permission scheme for the physical pages that is based on the concept of non-inclusive sets of memory permissions for different layers of system software such as hypervisors, operating systems, and user-level applications. Instead of viewing privilege lev-els as an ordered hierarchy with each successive level being more privileged, we view them as distinct levels each with its own set of permissions. Such a permission mechanism, imple-mented as part of a processor architecture, provides a common framework for defending against a range of recent attacks. We demonstrate that such a protection can be achieved with neg-ligible performance overhead, low hardware complexity and minimal changes to the commodity OS and hypervisor code. 1.
Keyphrases
non-inclusive memory permission architecture protection cross-layer attack user-level application system software neg-ligible performance overhead permission mechanism privileged sys-tem software current archi-tectures commodity o low hardware complexity single exploit distinct level software layer privilege lev-els hypervisor code recent attack non-inclusive set ordered hierarchy compromised high-privileged software layer arbitrary malicious activity complex software stack minimal change hardware-supported page permission scheme successive level memory permission physical page possible attack different layer inclusive permission modern computer system modern commodity system processor architecture common framework
