2019/05/15 by Salessawi Ferede Yitbarek, Yitbarek, Salessawi Ferede, Todd Austin +1
Computer Science · #Advanced Malware Detection Techniques #Cloud Data Security Solutions #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Operating Systems (cs.OS) #Security and Verification in Computing
paper · pdf · doi:10.48550/arxiv.1905.05975
openalex publication_date 2019/05/15 · openalex created_date 2022/10/02 · openalex updated_date 2026/07/28
The security of applications hinges on the trustworthiness of the operating\nsystem, as applications rely on the OS to protect code and data. As a result,\nmultiple protections for safeguarding the integrity of kernel code and data are\nbeing continuously proposed and deployed. These existing protections, however,\nare far from ideal as they either provide partial protection, or require\ncomplex and high overhead hardware and software stacks.\n In this work, we present Neverland: a low-overhead, hardware-assisted, memory\nprotection scheme that safeguards the operating system from rootkits and\nkernel-mode malware. Once the system is done booting, Neverland's hardware\ntakes away the operating system's ability to overwrite certain configuration\nregisters, as well as portions of its own physical address space that contain\nkernel code and security-critical data. Furthermore, it prohibits the CPU from\nfetching privileged code from any memory region lying outside the physical\naddresses assigned to the OS kernel and drivers (regardless of virtual page\npermissions). This combination of protections makes it extremely hard for an\nattacker to tamper with the kernel or introduce new privileged code into the\nsystem -- even in the presence of kernel vulnerabilities. Our evaluations show\nthat the extra hardware required to support these protections incurs minimal\nsilicon and energy overheads. Neverland enables operating systems to reduce\ntheir attack surface without having to rely on complex integrity monitoring\nsoftware or hardware.\n