The advent of cloud computing and inexpensive
multi-core desktop architectures has lead to the widespread adoption of
virtualization technologies. Furthermore, security researcher’s embraced
virtual machine monitors (VMMs) as a new mechanism to guarantee deep isolation
of untrusted software components, which coupled with their popularity promoted
VMMs as a prime target for exploitation. In this paper, we present Hyper Check,
a hardware-assisted tampering detection framework designed to protect the
integrity of hypervisors and operating systems. Our approach leverages System
Management Mode (SMM), a CPU mode in x86 architecture, to transparently and
securely acquire and transmit the full state of a protected machine to a remote
server. We have implement two prototypes based on our framework design: Hyper
Check-I and Hyper Check-II, that vary in their security assumptions and OS code
dependence. In our experiments, we are able to identify root kits that target
the integrity of both hypervisors and operating systems. We show that Hyper
Check can defend against attacks that attempt to evade our system. In terms of
performance, we measured that Hyper Check can communicate the entire static
code of Xen hypervisor and CPU register states in less than 90 million CPU cycles,
or 90 ms on a 1 GHz CPU
No comments:
Post a Comment