A dynamic per-context verification of kernel address integrity from external monitors

Cited 0 time in webofscience Cited 0 time in scopus
  • Hit : 131
  • Download : 0
The introduction of Address Translation Redirection Attack (ATRA) has revealed a critical weakness in all existing hardware-based external kernel integrity monitors. The attack redefines system's memory mappings in favor of the attacker so that the monitored kernel regions are relocated out of the monitor's sight. We provide a generalized approach and a prototype evaluation to prove our proposed scheme for ensuring the integrity of kernel address mapping from external monitors. With a slight modification on the hardware-side on the host, we were able to enable the monitor to continuously trace Page Table Base Register (PTBR) of the host which is an essential capability in monitoring the host memory mapping integrity. In conjunction with this hardware feature, we incorporate our findings on the invariant of the kernel memory mapping patterns to implement a dynamic per-context page table monitoring scheme. Our experiment proves the viability of our work in terms of its effectiveness against memory mapping manipulation attacks such as ATRA and satisfies the time constraints required by the proposed per-context mapping verification scheme. (C) 2018 Elsevier Ltd. All rights reserved.
Publisher
ELSEVIER ADVANCED TECHNOLOGY
Issue Date
2018-08
Language
English
Article Type
Article
Citation

COMPUTERS & SECURITY, v.77, pp.824 - 837

ISSN
0167-4048
DOI
10.1016/j.cose.2018.02.013
URI
http://hdl.handle.net/10203/246591
Appears in Collection
CS-Journal Papers(저널논문)
Files in This Item
There are no files associated with this item.

qr_code

  • mendeley

    citeulike


rss_1.0 rss_2.0 atom_1.0