Design and implementation of a model for OS kernel integrity protection

作者：Tian, Dong-Hai; Chen, Jun-Hua^*; Jia, Xiao-Qi; Hu, Chang-Zhen

来源：Journal on Communications, 2015, 36: 2015289.

DOI：10.11959/j.issn.1000-436x.2015289

• Design and implementations
• Hardware-assisted
• Integrity protection
• Kernel extensions
• Kernel space
• Prototype system
• Virtualization technologies

Untrusted kernel extensions were considered to be a big threat to OS kernel integrity because once they were loaded into the kernel space, then they may corrupt both the OS kernel data and code at will. To address this problem, MAC-based model named MOKIP for OS kernel integrity protection was presented. The basic idea of MOKIP was to set different integrity labels for different entities in the kernel space, and then ensure that the entities with low integrity label cannot harm the entities with high integrity label. A prototype system based on the hardware assisted virtualization technology was implemented. The experimental results show that proposed system is effective at defending against various malicious kernel extension attacks within a little performance overhead which is less than 13%.

• 出版日期2015-11-1
• 单位信息安全国家重点实验室; 北京理工大学