Efficient Virtualization-Based Application Protection Against Untrusted Operating System

Abstract

Commodity monolithic operating systems are abundant with vulnerabilities that lead to rootkit attacks. Once an operating system is subverted, the data and execution of user applications are fully exposed to the adversary, regardless whether they are designed and implemented with security considerations. Existing application protection schemes have various drawbacks, such as high performance overhead, large Trusted Computing Base (TCB), or hardware modification. In this paper, we present the design and implementation of AppShield, a hypervisor-based approach that reliably safeguards code, data and execution integrity of a critical application, in a more efficient way than existing systems. The protection overhead is localized to the protected application only, so that unprotected applications and the operating system run without any performance loss. In addition to the performance advantage, AppShield tackles several newly identified threats in this paper which are not systematically addressed previously. We build a prototype of AppShield with a tiny hypervisor, and experiment with AppShield by running several off-the-shelf applications on a Linux platform. The results testify to AppShield's low performance costs in terms of CPU computation, disk I/O and network I/O.

Data exfiltration: A review of external attack vectors and countermeasures

“…Cheng et al [57] present a hypervisor-based approach, AppShield, for protecting data, code and execution integrity of an application against OS level malware attacks. In this design, hypervisor separates the address space for application to be protected from the rest of the applications.…”

“…Shu et al [55] In use An approach for secure file sharing where access is controlled through proxy server which utilizes the keys stored with each file Denial of Service attack, Rollback attack, Passive monitoring, Timing channel attack Cheng et al [57] In use Approach for protection of application's data from kernel level attacks where hypervisor provides the services of authorizing requests from kernel.…”

“…The fact reported in Data Breach Investigation Report [181] of Verizon Inc. endorses our observation, which states that in 86% of the cases, the evidence of data breach attack was recorded by the installed detection system, which could not analyse and report the data breaches in a timely fashion. In our review, we found a number of countermeasures (e.g., [39], [40], [41], [42], [44], [48], [52], [53], [55], [57], [76], [83], [84], [86], [87], [95], [97], [112], [113],…”

Controlled-Channel Attacks: Deterministic Side Channels for Untrusted Operating Systems

“…The past years have seen a significant effort in the design of systems that shield applications from the operating system [19], [18], [49], [42], [27], [20], [22], [35], [10]. Such shielding systems typically use trusted hardware or a hypervisor to prevent the operating system from reading or writing to an application's memory and from directly tampering with its execution.…”

Secure Containers in Android: the Samsung KNOX Case Study

“…Therefore, for example, when the kernel wishes to modify a page table entry, it calls a dedicated inner function, the SMC call transparently reroutes the control flow to RKP running within the TrustZone which performs the operation and returns control to the kernel. This mode of operation resembles hardware-based paravirtualization [30], in which the TrustZone plays the role of the hypervisor and the kernel calls to it to perform key tasks in a secure manner. A similar mechanism to RKP, but with less features is presented in Sprobes [39].…”