The Community for Technology Leaders
Green Image
Issue No. 04 - July-Aug. (2014 vol. 11)
ISSN: 1545-5971
pp: 332-344
Fengwei Zhang , Department of Computer Science , George Mason University, 4400 University Drive, Room 437, Research Hall,
Jiang Wang , Riverbed Technology, 46864 Winema Common, Fremont,
Kun Sun , Center for Secure Information Systems, George Mason University, 4400 University Drive, Room 417, Research Hall ,
Angelos Stavrou , Department of Computer Science , George Mason University, 4400 University Drive, Room 437, Research Hall,
The advent of cloud computing and inexpensive multi-core desktop architectures has led to the widespread adoption of virtualization technologies. Furthermore, security researchers embraced virtual machine monitors (VMMs) as a new mechanism to guarantee deep isolation of untrusted software components, which, coupled with their popularity, promoted VMMs as a prime target for exploitation. In this paper, we present HyperCheck, a hardware-assisted tampering detection framework designed to protect the integrity of hypervisors and operating systems. Our approach leverages System Management Mode (SMM), a CPU mode in $\times86$ architecture, to transparently and securely acquire and transmit the full state of a protected machine to a remote server. We have implement two prototypes based on our framework design: HyperCheck-I and HyperCheck-II, that vary in their security assumptions and OS code dependence. In our experiments, we are able to identify rootkits that target the integrity of both hypervisors and operating systems. We show that HyperCheck can defend against attacks that attempt to evade our system. In terms of performance, we measured that HyperCheck can communicate the entire static code of Xen hypervisor and CPU register states in less than 90 million CPU cycles, or 90 ms on a 1 GHz CPU.
Virtual machine monitors, Registers, Monitoring, Kernel, Biomedical monitoring, Hardware, Security,Coreboot, Hypervisor, system management mode, kernel
Fengwei Zhang, Jiang Wang, Kun Sun, Angelos Stavrou, "HyperCheck: A Hardware-AssistedIntegrity Monitor", IEEE Transactions on Dependable and Secure Computing, vol. 11, no. , pp. 332-344, July-Aug. 2014, doi:10.1109/TDSC.2013.53
95 ms
(Ver 3.3 (11022016))