Operating system security by integrity checking and recovery using write‐protected storage

Kaczmarek, Jerzy; Wróbel, Michał R.

doi:10.1049/iet-ifs.2012.0346

Cited by 12 publications

(4 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It can recover the original version of the subvirted file from a backup. Unlike ICAR, [2] stores all of the crucial data in a physically write-protected storage, and uses them to check file integrity. XenRIM [3] runs in Xen environment where the agents are running in VMs to intercept file operations and the server is running in Dom0 to receive logs sent by agents.…”

Section: Related Workmentioning

confidence: 99%

Protecting Critical Files Using Target-Based Virtual Machine Introspection Approach

Zhan

Fang

et al. 2017

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYProtecting critical files in operating system is very important to system security. With the increasing adoption of Virtual Machine Introspection (VMI), designing VMI-based monitoring tools become a preferential choice with promising features, such as isolation, stealthiness and quick recovery from crash. However, these tools inevitably introduce high overhead due to their operation-based characteristic. Specifically, they need to intercept some file operations to monitor critical files once the operations are executed, regardless of whether the files are critical or not. It is known that file operation is high-frequency, so operation-based methods often result in performance degradation seriously. Thus, in this paper we present CFWatcher, a target-based real-time monitoring solution to protect critical files by leveraging VMI techniques. As a target-based scheme, CFWatcher constraints the monitoring into the operations that are accessing target files defined by users. Consequently, the overhead depends on the frequency of target files being accessed instead of the whole filesystem, which dramatically reduces the overhead. To validate our solution, a prototype system is built on Xen with full virtualization, which not only is able to monitor both Linux and Windows virtual machines, but also can take actions to prevent unauthorized access according to predefined policies. Through extensive evaluations, the experimental results demonstrate that the overhead introduced by CFWatcher is acceptable. Especially, the overhead is very low in the case of a few target files.

show abstract

Section: Related Workmentioning

confidence: 99%

Protecting Critical Files Using Target-Based Virtual Machine Introspection Approach

Zhan

Fang

et al. 2017

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

show abstract

“…Based on VMI technology, many security monitor systems [12]- [14] have been proposed to protect VMs. Compared with the in-VM security tools [15], [16], VMI-based monitors are more secure and transparent.…”

Section: Related Workmentioning

confidence: 99%

A Low-Overhead Kernel Object Monitoring Approach for Virtual Machine Introspection

Zhan

et al. 2019

ICC 2019 - 2019 IEEE International Conference on Communications (ICC)

View full text Add to dashboard Cite

Monitoring kernel object modification of virtual machine is widely used by virtual-machine-introspection-based security monitors to protect virtual machines in cloud computing, such as monitoring dentry objects to intercept file operations, etc. However, most of the current virtual machine monitors, such as KVM and Xen, only support page-level monitoring, because the Intel EPT technology can only monitor page privilege. If the out-of-virtual-machine security tools want to monitor some kernel objects, they need to intercept the operation of the whole memory page. Since there are some other objects stored in the monitored pages, the modification of them will also trigger the monitor. Therefore, page-level memory monitor usually introduces overhead to related kernel services of the target virtual machine. In this paper, we propose a low-overhead kernel object monitoring approach to reduce the overhead caused by page-level monitor. The core idea is to migrate the target kernel objects to a protected memory area and then to monitor the corresponding new memory pages. Since the new pages only contain the kernel objects to be monitored, other kernel objects will not trigger our monitor. Therefore, our monitor will not introduce runtime overhead to the related kernel service. The experimental results show that our system can monitor target kernel objects effectively only with very low overhead.

show abstract

“…Thus, there is no doubt that hash functions such as SHA-1 and SHA-2 have shown their usefulness in designing many existing verification proposals, and they are used as the measurement agent by the Trusted Computing Group [9], [10], [24]- [28]. For instance, [29] have utilized cryptographic hash generation and verification to introduce an integrity checking and recovery system solution to increase computer system security by the integrity checking of files that are vital for system operation. Also, they suggest storing all of the essential data in physically write-protected storage to reduce the threat of illegal alteration.…”

Section: Related Workmentioning

confidence: 99%

A Secure Protocol for Remote-Code Integrity Attestation of Embedded Systems: The CSP Approach

Al-Wosabi

Shukur

2019

IEEE Access

View full text Add to dashboard Cite

No doubt, a person of modern society relying on Embedded Systems (ESs) has increased rapidly and the era of digital machines is gaining popularity among users and also systems providers. At the same time, such instruments face substantial security challenges because they usually operate in a physically unprotected environment, and thus attract the attackers to gain unauthorized access for utilizing the system functions. Accordingly, system integrity is important and hence there is a need to propose a technique/tool to verify that the original/pure systems codes have been used in those devices. In this research, our main objective is to design a system architecture with a secure communication for code integrity attestation of an ES. Indeed, the study presents the proposed system architecture for ESs integrity attestation which includes two main phases: fetching an ES code at a server site and examining the ES at a remote site (using a designed user application). Essentially, the hash function (SHA-2) with a random key to calculate a unique digest value for a targeted system have been utilized. Also, the study used timestamps and nonce values, two secure keys, and public key algorithm to design a secure protocol in-order to prevent potential attacks during data and the associated values transfer between the server and the remote user application. As many researchers state that the formal methods are very precise and accurate for presenting system specifications; this study modeled and analyzed the proposed attestation protocol using the Communicating Sequential Processes (CSP) formal method approach. Besides, the Compiler for the Analysis of Security Protocols (Casper) has been used to translate the protocol description into the corresponding process algebra CSP model. Then, the researcher used the Failures Divergences Refinement (FDR) to evaluate the proposed protocol. Those formal method tools are considered as a reliable verification measurement in-order to figure-out potential flaws and correct them. Overall, the final output of checking all the defined secrecy and authentication assertions using FDR 4.2.0, and thus all the secrecy and authentication specifications defined in the developed Casper script are passed.INDEX TERMS Embedded systems, code integrity, code integrity attestation, software tampering, tampering detection, CSP formal method approach, FDR, Casper.

show abstract

Operating system security by integrity checking and recovery using write‐protected storage

Cited by 12 publications

References 16 publications

Protecting Critical Files Using Target-Based Virtual Machine Introspection Approach

Protecting Critical Files Using Target-Based Virtual Machine Introspection Approach

A Low-Overhead Kernel Object Monitoring Approach for Virtual Machine Introspection

A Secure Protocol for Remote-Code Integrity Attestation of Embedded Systems: The CSP Approach

Contact Info

Product

Resources

About