Speaker: Donghai Tian
Title: Protecting Kernel Data Integrity through Virtualization Technology
 
Abstract
 
Operating system security (OS) is the basis for trust computing. As
the kernel rootkits become popular and lots of kernel vulnerabilities
are exposed, the OS kernel suffers a large number of attacks. It is
difficult to protect the kernel by its own module in that the kernel
rootkits has the same ability to cripple the security module within
the same kernel space. Recently, with the virtualization renaissance,
virtualization technology provides many new ways to improve the system
security. Utilizing this new technology, we present a kernel
protection system called VMhuko. By monitoring the kernel data access
actively, VMhuko can defend the kennel data attacks on the fly. The
initial experiment shows that VMhuko can protect the kernel with
moderate performance.