一个基于硬件虚拟化的内核完整性监控方法

Approach of Kernel Integrity Monitoring Using Hardware Virtualization

对操作系统内核的攻击就是通过篡改关键数据和改变控制流来危及操作系统的安全。已有的一些方法通过保护代码完整性或控制流完整性来抵御这些攻击,但是这往往只关注于某一个方面而没有给出一个完整的监控方法。通过对内核完整性概念的分析,得出了在实际系统中保证内核完整性需要的条件:保障数据完整性,影响系统功能的关键数据对象只能由指定的代码在特定情况下修改;保障控制流完整性,保护和监控影响代码执行序列改变的所有因素。并采用硬件虚拟化的Xen虚拟机监控器实现对Linux内核的保护和监控。实验结果证明,该方法能够阻止外来攻击和本身漏洞对内核的破坏。

Kernel-level attacks compromise operating system security by tampering with critical data and control flow in the kernel. Current approaches defend against these attacks by applying code integrity or control flow integrity control methods. However, they focus on only a certain aspect and cannot give a complete integrity monitoring solution. This paper analyzed the kernel integrity principle and got practical requirements to ensure kernel integrity. Critical data ob- jects effect operating system function directly. Only certain code is able to modify critical data objects at certain condi- tions to ensure data integrity. All factors about code execution sequence are protected and monitored to ensure control flow integrity. Implementation in Xen VMM（Virtual Machine Monitor） using hardware virtualization, or referred to as HVM（Hardware Virtual Machine） is introduced to protect and monitor Linux kernel. Experiments show that the solu- tion can detect and prevent attacks and bugs compromising the kernel.