Towards a VMM-based usage control framework for OS kernel integrity protection

  • Authors:

  • Min Xu;Xuxian Jiang;Ravi Sandhu;Xinwen Zhang

  • Affiliations:

  • George Mason University, Fairfax, Virginia;George Mason University, Fairfax, Virginia;Univ. of Texas at San Antonio;Samsung Information Systems America, San Jose, California

  • Venue:
  • Proceedings of the 12th ACM symposium on Access control models and technologies
  • Year:
  • 2007

Quantified Score

Hi-index 0.00

Visualization

Abstract

Protecting kernel integrity is one of the fundamental security objectives in building a trustworthy operating system (OS). For this end, a variety of approaches and systems have been proposed and developed. However, access control models used in most of these systems are not expressive enough to capture important security requirements such as continuous policy enforcement and mutable process and object attributes. Even worse, most existing protection mechanisms in these systems reside in the same space as the running OS, which unfortunately can be disabled or subverted after an attacker successfully exploits kernel-level vulnerabilities (or features) to compromise the OS kernel. The increasing number of kernel-level root kit attacks clearly demonstrates this threat. In this paper we present a simple but effective usage control model UCONKI with unique properties of decision continuity and attribute mutability for OS kernel integrity protection. Further, to enforce UCONKI security policies, we propose a virtual machine monitor (VMM) based architecture that is isolated and protected from other untrusted processes inside a virtual machine (VM). We have implemented a proof-of-concept prototype in Linux to demonstrate the feasibility of our approach. Our experiments with 18 real-world kernel rootkits show that our approach is able to successfully detect and prevent all kernel integrity violations from them. Beyond kernel integrity protection, we also explore additional opportunities for general OS security, such as the confinement of process activities as well as the protection of system utility programs at the VMM level.