SecVisor: a tiny hypervisor to provide lifetime kernel code integrity for commodity OSes

By Arvind Seshadri, Mark Luk, Ning Qu, Adrian Perrig. Symposium on Operating Systems Principles, 2007

725 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Information Systems, Signal Processing

View Paper: https://www.semanticscholar.org/paper/72e1e9d4aa5e36259e0d23eca0939525d6e7d516

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Information Systems

In Signal Processing

Citations in the corpus

Comprehensive formal verification of an OS microkernel (2014, background): “…2006], isolation kernels [Whitaker et al. 2002], the use of small hypervisors as a minimal trust base [Gar.nkel et al. 2003; Singaravelu et al. 2006; Seshadri et al. 2007; Criswell et al. 2007], as well as systems that require the use of type-safe languages for all code except some dirty core…”
M2R: Enabling Stronger Privacy in MapReduce Computation (2015, methodology): “5Other hypervisor solutions such as TrustVisor [39], Overshadow [14], Nova [56], SecVisor [50] could equivalently be used”
Guest-Transparent Prevention of Kernel Rootkits with VMM-Based Memory Shadowing (2008, background): “SecVisor [ 7 ] is a closely related work that leverages new hardware extensions to enforce life-time kernel integrity and provide a guarantee similar to “NICKLE”.”
The Turtles Project: Design and Implementation of Nested Virtualization (2010, methodology): “It also enables new approaches to computer security, such as honeypots capable of running hypervisor-level root-kits [43], hypervisor-level rootkit protection [39,44], and hypervisor-level intrusion detection [18, 25]—for both hypervisors and operating systems.”
seL4: Formal Veriﬁcation of an OS Kernel (2009, methodology): “…kernels and separation kernels [38, 54], the MILS approach [4], microkernels [1,12,35,45,57,71] and isolation kernels [69], the use of small hypervisors as a minimal trust base [16,26,56,59], as well as systems that require the use of type-safe languages for all code except some“dirty”core [7,23].”
A Survey of Stealth Malware Attacks, Mitigation Measures, and Steps Toward Autonomous Open World Solutions (2016, methodology): “memory – a task that all kernel rootkits must perform to load themselves into memory in the first place [82].”
Behavioral detection of malware on mobile handsets (2008, background): “Countermeasures have been proposed for desktop environments, such as the rootkit revealer [1] and the tiny hypervisor to protect kernel code integrity [42].”
Eliminating the hypervisor attack surface for a more secure cloud (2011, background): “Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not madeordistributedforpro.t or commercial advantage and that copies bearthisnoticeand thefull citation onthe .rstpage.”
Hypervision Across Worlds: Real-time Kernel Protection from the ARM TrustZone Secure World (2014, background): “Hypervisor-based approaches, such as [12,20,23,24,30,31, 35,38,43–45,50,52], use virtualization to provide their security tools with high privilege and isolation.”
Efficient TCB Reduction and Attestation (2009, background): “develop SecVisor, a small hypervisor that protects kernel code integrity [19].”
Baggy Bounds Checking: An Efficient and Backwards-Compatible Defense against Out-of-Bounds Errors (2009, background): “These systems suffer memory overheads per pointer in order to provide optional temporal protection [36] and sub-object protection [23] and”
HyperSafe: A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity (2010, methodology): “Notice that our attack model is similar to that used in SecVisor [40]; however, one key distinction is that HyperSafe is designed to protect the hypervisor itself while SecVisor aims to protect the guest kernel code integrity using a small trusted hypervisor.”
TrustVisor: Efficient TCB Reduction and Attestation (2010, methodology): “We have implemented TrustVisor to protect security-sensitive code blocks while imposing less than 7% overhead on the legacy OS and its applications in the common case.”
The Evolution of Process Hiding Techniques in Malware - Current Threats and Possible Countermeasures (2017, background): “SecVisor [52] and NICKLE [45] even take on a step before and prevent the injection of malicious code into the kernel.”