SecVisor: A tiny hypervisor to provide lifetime kernel code integrity for commodity OSes

Operating Systems Review (ACM)

Volumn , Issue , 2007, Pages 335-350

  Seshadri, Arvind ^a   Luk, Mark ^a   Qu, Ning ^a   Perrig, Adrian ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

Code attestation; Code injection attacks; Code integrity; Hypervisor; Memory virtualization; Preventing

Indexed keywords

CODES (SYMBOLS); DATA STORAGE EQUIPMENT; PROGRAM PROCESSORS; SECURITY OF DATA; QUALITY ASSURANCE;

CODE ATTESTATION; CODE INJECTION ATTACKS; CODE INTEGRITY; HYPERVISOR; MEMORY VIRTUALIZATION;

INFORMATION SERVICES; COMPUTER OPERATING SYSTEMS;

CODE ATTESTATION; CODE INJECTION ATTACKS; CODE INTEGRITY; HYPERVISOR; MEMORY VIRTUALIZATION;

EID: 41149103393     PISSN: 01635980     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1294261.1294294     Document Type: Conference Paper

References (26)

1. Advanced Micro Devices. AMD64 Architecture Programmer's Manual Volume 2: System Programming, 3.1.2 edition, September 2006.
2. Advanced Micro Devices. AMD64 Architecture Programmer's Manual Volume 3: General-Purpose and System Instructions, 3.12 edition, September 2006.
3. M. Becher, M. Dornseif, and C.N. Klein. FireWire all your memory are belong to us. In Proceedings of CanSecWest, 2005.
4. S. Chen, J. Xu, B.C. Sezer, P. Gauriar, and R.K. Iyer. Non-control-data attacks are realistic threats. In Proceedings of the 1.4th USENIX. Security Symposium, pages 177-192, August. 2005.
5. A. Chuvakin. Ups and downs of UNIX/Linux host-based security solutions. ;login: The Magazine of USENIX and SAGE, 28(2), April 2003.
6. J. Criswell, A. Lenharth, D. Dhurjati, and V. Adve. Secure virtual architecture: A safe execution environment for commodity operating systems. In Proceedings of ACM Symposium on Operating Systems Principles, Oct 2007.
7. J. Dyer, M. Lindemann, R. Perez, R. Sailer, L. van Doom, S.W. Smith, and S. Weingart. Building the IBM 4758 Secure Coprocessor. IEEE Computer, 34(10):57-66, 2001.
8. T. Garfinkel, B. Pfaff, J. Chow, M. Rosenblum, and D. Boneh. Tena: A virtual machine-based platform for trusted computing. In In Proceedings of ACM. Symposium on Operating Systems Principles (SOSP),'2003.
9. T. Garfinkel and M. Rosenblum. A virtual machine introspection based architecture for intrusion detection. In Proc. Network and Distributed Systems Security Symposium, February 2003.
10. Intel Corporation. Trusted execution Technology - preliminary architecture specification and enabling considerations. Document number 31516803, November 2006.
11. K. J. Jones. Loadable Kernel Modules, ;iogin: The Magazine of USENLX and SAGE, 26(7), November 2001.
12. P. Jones. RFC3174: US Secure Hash Algorithm 1 (SHA-1). http://www.faqs.org/rfcs/rfc3174. html, September 2001.
13. K. Kaneda. Tiny virtual machine monitor. http://www.yl.is.s.u-tokyo.ac. jp/~kaneda/tvmm/.
14. V. Kiriansky, D. Bruening, and S. Amarasinghe. Secure execution via program shepherding. In Proceedings of the 11th USENIX Security Symposium, August 2002.
15. L. McVoy and C. Staelin. lmbench: Portable tools for performance analysis. In Proceedings of the USENLX1996 Annual Technical Conference, Jan. 1996.
16. R. Minnich, J. Hendricks, and D. Webster. The Linux BIOS. In Proceedings of the 4th Annual Linux Showcase and Conference, Oct. 2000.
17. N. Petroni, T. Fraser, J. Molina, and W. Arbaugh. Copilot - a coprocessor-based kernel, runtime integrity monitor. In. Proceedings of USENIX Security Symposium, pages 179-194, 2004.
18. R. Russell. Lguest: The simple x86 hypervisor. http://lguest.ozlabs.org/.
19. J. Rutkowska. Beyond the CPU: Defeating hardware based RAM acquisition. In Proceedings of BlackHat DC 2007, Feb 2007.
20. A. Seshadri, M. Luk, E. Shi, A. Perrig, L. van Doom, and P. Khosla. Pioneer: Verifying integrity and guaranteeing execution of code on legacy platforms. In Proceedings of ACM Symposium on Operating Systems Principles (SOSP), pages 1-15, October 2005.
21. H. Shacham. The geometry of innocent flesh on the bone: Return-into-libc without function calls (on the x86). In Proceedings of the 14th ACM. Conference on Computer and Communications Security, Oct 2007.
22. S.W. Smith and S.H. Weingart. Building a high-performance, programmable secure coprocessor. Computer Networks (Special Issue on Computer Network Security), 31:831-960, 1999.
23. J. von Neumann. First draft of a report on the EDVAC. In B. Randall, editor, The origins of digital computers: selected papers, pages 383-392. 1982.
24. Y Wang, R. Roussev, C. Verbowski, A. Johnson, and D. Ladd. AskStrider: What has changed on my machine lately? Technical Report MSR-TR-2004-03, Microsoft Research, 2004.
25. Y. Wang, B. Vo, R. Roussev, C. Verbowski, and A. Johnson. Strider GhostBuster: Why it's a bad idea for stealth software to hide files. Technical Report. MSR-TR-2004-71, Microsoft Research, 2004.
26. G. Wurster, P. van Oorschot, and A. Somayaji. A generic attack on checksumming-based software tamper resistance. In Proceedings of IEEE Symposium on Security and Privacy, May 2005.