Abstract
Kernel extensions, especially device drivers, make up a large fraction of modern OS kernels (approximately 70% in Linux). Most extensions are benign and represent a convenient approach for extending the kernel functionality and allowing a system to communicate with an increasing number of I/O devices. A small fraction of them are malicious and, as they run in kernel space, pose a threat to kernel integrity. From a security viewpoint this situation is paradoxical: modern OSes depend and must co-live with untrustworthy but needed extensions. Our immune system faces the same challenge: our body is made of a large number of bacteria, which are mostly benign and also carry out critical functions for our physiology. However, a small fraction of them pose a threat to our body as they can cause pathologies. The immune system maintains an homeostatic relationship with its microbiota by minimizing contact between bacteria and cell surfaces and confining bacteria to certain sites. Challenging the current trend that advocates leveraging only a hypervisor to defend the kernel (for considering it too vulnerable to defend itself), this paper advocates that modern OSes, like our immune system, should play an active role in maintaining healthy and safe interactions with their extensions. This work presents Ianus, a proof-of-concept prototype for this paradigm using Linux and the Bochs x86 emulator, which successfully minimized kernel extensions interactions with original kernel. Its security was evaluated with real rootkits and benign modules. Ianus' performance was analyzed with system and CPU benchmarks and it caused an small overhead to the system (approximately 12%).
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Disclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.