Secure in-VM monitoring using hardware virtualization

Kernel-level attacks or rootkits can compromise the security of an operating system by executing with the privilege of the kernel. Current approaches use virtualization to gain higher privilege over these attacks, and isolate security tools from the untrusted guest VM by moving them out and placing them in a separate trusted VM. Although out-of-VM isolation can help ensure security, the added overhead of world-switches between the guest VMs for each invocation of the monitor makes this approach unsuitable for many applications, especially fine-grained monitoring. In this paper, we present Secure In-VM Monitoring (SIM), a general-purpose framework that enables security monitoring applications to be placed back in the untrusted guest VM for efficiency without sacrificing the security guarantees provided by running them outside of the VM. We utilize contemporary hardware memory protection and hardware virtualization features available in recent processors to create a hypervisor protec...

• Type: Conference
• Year: 2009
• Where: CCS
• Authors: Monirul I. Sharif, Wenke Lee, Weidong Cui, Andrea Lanzi
• Keywords: CCS 2009, Guest Vm, Security, Security Privacy, Untrusted Guest Vm