Linux kernel integrity measurement using contextual inspection

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2007, Pages 21-29

  Loscocco, Peter A ^a   Wilson, Perry W ^b   Aaron Pendergrass, J ^b   Durward McDonell, C ^b  

^a NATIONAL SECURITY AGENCY   (United States)

^b JOHNS HOPKINS UNIVERSITY APPLIED PHYSICS LABORATORY   (United States)

Author keywords

Attestation systems; Integrity measurement; LKIM; System monitoring

Indexed keywords

LINUX; MONITORING;

ATTESTATION SYSTEM; CONVENTIONAL METHODS; INTEGRITY MEASUREMENT; INTEGRITY MONITOR; LINUX KERNEL; LINUX KERNEL INTEGRITY MONITOR; SOFTWARE INTEGRITY; STATIC CODES; STATIC DATUM; SYSTEM MONITORING;

INSPECTION;

EID: 79959553321     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1314354.1314362     Document Type: Conference Paper

References (20)

1. P. Barham, B. Dragovic, et al. Xen and the art of virtualization. Proceedings of the Nineteenth ACM Symposium on Operating Systems Principles, pages 164-177, 2003. (Pubitemid 40929695)
2. V. Haldar, D. Chandra, and M. Franz. Semantic remote attestation - a virtual machine directed approach to trusted computing. Proceedings of the 3rd USENIX Virtual Machine Research & Technology Symposium, May 2004.
3. D. Heine and Y. Kouskoulas. N-force daemon prototype technical description. Technical Report VS-03-021, The Johns Hopkins University Applied Physics Laboratory, July 2003.
4. P. Iglio. Trustedbox: a kernel-level integrity checker. In ACSAC '99: Proceedings of the 15th Annual Computer Security Applications Conference, page 34. IEEE Computer Society, 1999.
5. Intel Corporation. IA-32 Intel Architecture Software Develper's Manual, 2004.
6. T. Jaeger, R. Sailer, and U. Shankar. Prima: Policy-reduced integrity measurement architecture. SACMAT 06: Proceedings of the Eleventh A CM Symposium on Access Control Models and Technologies, 2006.
7. G. Kim and E. Spafford. The Design and Implementation of Tripwire: A File System Integrity Checker. Purdue Univiversity, November 1993.
8. J. Levine, J. Grizzard, and H. Owen. Detecting and categorizing kernel-level rootkits to aid future detection. IEEE Security and Privacy, 2006.
9. P. Loscocco and S. Smalley. Integrating flexible support for security policies into the linux operating system. Proceedings of the FREENIX Track, June 2001.
10. P. Loscocco, P. Wilson, et al. Measuring the linux kernel using contextual measurement. Technical Report AI-07-077, The Johns Hopkins University Applied Physics Laboratory, August 2007.
11. Mindcraft, Inc., http://www.mindcraft.com. WebStone 2.x Benchmark Description.
12. G. Mohay and J. Zellers. Kernel and shell based applications integrity assurance. In ACSAC '97: Proceedings of the 13th Annual Computer Security Applications Conference, page 34. IEEE Computer Society, 1997.
13. N. Petroni Jr., T. Fraser, et al. Copilot - a coprocessor-based kernel runtime integrity monitor. Proceedings of the 13th Usenix Security Symposium, pages 179-194, August 2004.
14. N. Petroni Jr., T. Fraser, et al. An architecture for specification-based detection of semantic integrity violations in kernel dynamic data. Security '06: 15th USENIX Security Symposium, 2006.
15. R. Sailer, X. Zhang, et al. Design and implementation of a TCG-based integrity measurement architecture. Proceedings of the 13th Usenix Security Symposium, pages 223-238, August 2004.
16. A. Seshardri, M. Luk, et al. Pioneer: Verifying code integrity and enforcing untampered code execution on legacy systems. ACM Symposium on Operating Systems Principles, October 2005.
17. J. Sheehy, G. Coker, et al. Attestation evidence and trust. Technical Report 07-0186, MITRE Corporation, March 2007.
18. Tool Interface Standards Committee. DWARF Debugging Information Format Specification v2.0, May 1995.
19. Tool Interface Standards Committee. Executable and Linking Format (ELF), v1.2 edition, May 1995.
20. Trusted Computing Group, https://www.trustedcomputinggroup.org. TCG Specification Architecture Overview - Specification Revision 1.2, April 2004.