通信学报 ›› 2015, Vol. 36 ›› Issue (Z1): 118-125.doi: 10.11959/j.issn.1000-436x.2015289

• 学术论文 • 上一篇    下一篇

内核完整性保护模型的设计与实现

田东海1,2,陈君华2,贾晓启3,胡昌振1   

  1. 1 北京理工大学 北京市软件安全工程技术重点实验室，北京 100081
    2 Key Laboratory of IDT Application Technology of Universities in Yunnam Province,Yunnam Minzu University,Kunming 650500,China
    3 中国科学院 信息工程研究所 信息安全国家重点实验室，北京 100093
  • 出版日期:2015-11-25 发布日期:2015-12-29
  • 基金资助:
    国家高技术研究发展计划（“863”计划)基金资助项目;中科院先导科技专项基金资助项目;国家自然科学基金资助项目;国家自然科学基金资助项目;云南省高校物联网应用技术重点实验室开放基金资助项目

Design and implementation of a model for OS kernel integrity protection

Dong-hai TIAN1,2,Jun-hua CHEN2,Xiao-qi JIA3,Chang-zhen HU1   

  1. 1 Beijing Key Laboratory of Software Security Engineering Technology,Beijing Institute of Technology,Beijing 100081 China
    2 School of Management Zhengzhou 451191, China
    3 State Key Laboratory of Information Security,Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China
  • Online:2015-11-25 Published:2015-12-29
  • Supported by:
    The National High Technology Research and Development Program of China (863 Program);The Strategic Priority Research Program of the Chinese Academy of Sciences;The National Natural Science Foundation of China;The National Natural Science Foundation of China;Open Found of Key Laboratory of IOT Application Technology of Universities in Yunnan Province

在线阅读

11

PDF下载

1683

摘要：

非可信内核扩展模块是对操作系统内核完整性安全的重要威胁之一，因为它们一旦被加载到内核空间，将可能任意破坏操作系统内核数据和代码完整性。针对这一问题，提出了一种基于强制访问控制对操作系统内核完整性保护的模型—MOKIP。该模型的基本思想是为内核空间中的不同实体设置不同的完整性标签，然后保证具有低完整性标签的实体不能破坏具有高完整性标签的实体。基于硬件辅助的虚拟化技术实现了原型系统，实验结果表明，本系统能够抵御各种恶意内核扩展模块的攻击，其性能开销被控制在13%以内。

关键词: 内核扩展模块, 操作系统内核, 完整性保护, 虚拟化技术

Abstract:

Untrusted kernel extensions were considered to be a big threat to OS kernel integrity because once they were loaded into the kernel space,then they may corrupt both the OS kernel data and code at will.To address this problem,MAC-based model named MOKIP for OS kernel integrity protection was presented.The basic idea of MOKIP was to set different integrity labels for different entities in the kernel space,and then ensure that the entities with low integrity label cannot harm the entities with high integrity label.A prototype system based on the hardware assisted virtualization technology was implemented.The experimental results show that proposed system is effective at defending against various malicious kernel extension attacks within a little performance overhead which is less than 13%.

Key words: kernel extensions, OS kernel, integrity protection, virtualization technology

No Suggested Reading articles found!