Modeling the runtime integrity of cloud servers: A scoped invariant perspective

Proceedings - 2nd IEEE International Conference on Cloud Computing Technology and Science, CloudCom 2010

Volumn , Issue , 2010, Pages 651-658

  Wei, Jinpeng ^a   Pu, Calton ^b   Rozas, Carlos V ^c   Rajan, Anand ^c   Zhu, Feng ^a  

^a FLORIDA INTERNATIONAL UNIVERSITY   (United States)

^b GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

^c INTEL CORPORATION   (United States)

Author keywords

Integrity modeling; Invariants detection; Tools; Xen

Indexed keywords

BUFFER OVERFLOWS; COMPUTING SECURITY; DESCRIPTORS; INTEGRITY MODELING; INVARIANTS DETECTION; RUN-TIME SOFTWARE; RUNTIMES; SOFTWARE SYSTEMS; VIRTUAL-MACHINE MANAGERS; XEN;

COMPUTER SYSTEMS; SERVERS;

CLOUD COMPUTING;

EID: 79952380988     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CloudCom.2010.29     Document Type: Conference Paper

References (28)

1. M. Abadi, M. Budiu, U. Erlingsson, and J. Ligatti, "Controlflow integrity", ACM Conference on Computer and Communications Security (CCS), Alexandria, VA, Nov. 2005.
2. W. A. Arbaugh, D. J. Farber, and J. M. Smith, "A secure and reliable bootstrap architecture", In IEEE Computer Society Conference on Security and Privacy. IEEE, 1997, pp. 65-71.
3. A. Baliga, P. Kamat and L. Iftode, "Lurking in the shadows: identifying systemic threats to kernel data", IEEE Symposium on Security and Privacy, Oakland, CA, May 2007.
4. P. Barham, B. Dragovic, K. Fraser, et al., "Xen and the art of virtualization", ACM Symposium on Operating Systems Principles (SOSP), Bolton Landing, NY, Oct. 2003.
5. F. Bellard, "QEMU, a fast and portable dynamic translator", Proceedings of the 2005 USENIX Annual Technical Conference, 2005.
6. chkrootkit. http://www.chkrootkit.org/, accessed August 16, 2010.
7. L. Davi, A. Sadeghi, and M. Winandy, "Dynamic Integrity Measurement and Attestation: Towards Defense against Return-Oriented Programming Attacks", Proceedings of the 2009 ACM workshop on Scalable Trusted Computing (STC). November 2009.
8. M. D. Ernst, J. H. Perkins, P. J. Guo, S. McCamant, C. Pacheco, M. S. Tschantz, and C. Xiao, "The Daikon system for dynamic detection of likely invariants", In Science of Computer Programming, 2007.
9. T. Garfinkel, M. Rosenblum, "A virtual machine introspection based architecture for intrusion detection", Proceedings of Network and Distributed Systems Security Symposium (NDSS), February 2003.
10. J. Grizzard, E. Dodson, G. Conti, J. Levine, and H. Owen, "Toward a trusted immutable kernel extension (TIKE) for selfhealing systems: a virtual machine approach", Proceedings of 5th IEEE Information Assurance Workshop, 2004.
11. Intel 64 and IA-32 Architectures Software Developer's Manual, Vol. 3A: System Programming Guide, Part 1.
12. Intel 64 and IA-32 Architectures Software Developer's Manual, Vol. 3B: System Programming Guide, Part 2.
13. IT Cloud Services User Survey, pt.2: Top Benefits & Challenges. http://blogs.idc.com/ie/?p=210, accessed August 16, 2010.
14. T. Jaeger, R. Sailer, and U. Shankar, "PRIMA: policyreduced integrity measurement architecture", Proceedings of the 11th ACM Symposium on Access Control Models and Technologies (SACMAT 2006), June 2006.
15. C. Kil, E. Sezer, A. Azab, P. Ning, and X. Zhang, "Remote attestation to dynamic system properties: Towards providing complete system integrity evidence", Proceedings of the 39th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN'09), Lisbon, Portugal, 2009.
16. J. Levine and J. Grizzard and H. Owen, "Re-establishing trust in compromised systems: recovering from rootkits that trojan the system call table", Proceedings of 9th European Symposium on Research in Computer Security, Sophia Antipolis, France, September 2004.
17. Xen local security-bypass vulnerability. http://www.securityfocus.com/ bid/26954/discuss, accessed August 16, 2010.
18. Xen "move-to-rr" RID local security bypass vulnerability. http://www.securityfocus.com/bid/26716/discuss, accessed August 16, 2010.
19. P. A. Loscocco, P. W. Wilson, J. A. Pendergrass, C. D. McDonell, "Linux kernel integrity measurement using contextual inspection", Proceedings of the 2007 ACM workshop on Scalable Trusted Computing (STC). October 2007.
20. N. Petroni, Jr., T. Fraser, J. Molina, W. A. Arbaugh, "Copilot - a coprocessor-based kernel runtime integrity monitor", 13th USENIX Security Symposium, San Diego, CA, Aug. 2004.
21. N. Petroni, T. Fraser, A. Walters, and W. Arbaugh, "An architecture for specification-based detection of semantic integrity violations in kernel dynamic data", 15th USENIX Security Symposium, 2006.
22. N. Petroni and M. Hicks, "Automated detection of persistent kernel control-flow attacks", 14th ACM Conference on Computer and Communications Security (CCS), Alexandria, VA, Oct. 2007.
23. R. Sailer, X. Zhang, T. Jaeger, L. van Doorn, "Design and implementation of a TCG-based integrity measurement architecture", 13th USENIX Security Symposium, 2004.
24. J. Sheehy, G. Coker, J. Guttman, et al. "Attestation: evidence and trust", http://www.mitre.org/work/tech-papers/tech-papers-07/07-0186/07- 0186.pdf, accessed August 16, 2010.
25. L. Singaravelu, C. Pu, H. Haertig, C. Helmuth, "Reducing TCB complexity for security-sensitive applications: three case studies", 1st ACM SIGOPS/EuroSys European Conference on Computer Systems, Leuven, Belgium, April 2006.
26. Trusted Computing Group. http://www.trustedcomputinggroup.org, accessed August 16, 2010.
27. Trusted Platform Modules. http://www.trustedcomputinggroup.org/ developers/trusted-platform-module/specifications, accessed August 16, 2010.
28. X. Zhang, L. van Doorn, T. Jaeger, R. Perez, and R. Sailer, "Secure coprocessor-based intrusion detection", Tenth ACM SIGOPS European Workshop, Saint-Emilion, France, September 2002.