Retrofitting AMD x86 Processors with Active Virtual Machine Introspection Capabilities

被引：1

作者：

Dangl, Thomas ^{[1
]}

Sentanoe, Stewart ^{[1
]}

Reiser, Hans P. ^{[2
]}

机构：

[1] Univ Passau, Innstr 43, D-94032 Passau, Germany

[2] Reykjavik Univ, Menntavegur 1, Reykjavik, Iceland

来源：

ARCHITECTURE OF COMPUTING SYSTEMS, ARCS 2023 | 2023年 / 13949卷

关键词：

virtual machine introspection; monitoring; system security; reliability; stealthiness; cloud computing;

D O I：

10.1007/978-3-031-42785-5_12

中图分类号：

TP18 [人工智能理论];

学科分类号：

081104 ; 0812 ; 0835 ; 1405 ;

摘要：

Active virtual machine introspection mechanisms intercept the control flow of a virtual machine running on top of a hypervisor. They enable external tools to monitor and inspect the state at predetermined locations of interest synchronous to the execution of the system. Such mechanisms, in particular, require support from the processor vendor by facilitating interpositioning. This support is missing on AMD x86 processors, leading to inferior introspection solutions. We outline implicit assumptions about active introspection mechanisms in previous work, offer constructions for solution strategies on AMD systems and discuss stealthiness and correctness. Finally, we show empirically that such retrofitted software solutions exhibit performance metrics in the same order of magnitude as native hardware solutions.

引用

页码：168 / 182

页数：15

共 20 条

[1]

Advanced Micro Devices, 2019, AMD64 Architecture Programmer's Manual, V2

[2]

[Anonymous], 2003, P NETW DISTR SYST SE

[3]

[Anonymous], 1983, Byte Magazine: byte-unixbench

[4]

Barham P., 2003, Operating Systems Review, V37, P164, DOI 10.1145/1165389.945462

[5]

Intel Corporation, 2009, Intel R 64 and IA-32 Architectures Software Developer's Manual, V2A

[6] SoK: Introspections on Trust and the Semantic Gap [J].

Jain, Bhushan ;

Baig, Mirza Basim ;

Zhang, Dongli ;

Porter, Donald E. ;

Sion, Radu .

2014 IEEE SYMPOSIUM ON SECURITY AND PRIVACY (SP 2014), 2014, :605-620

[7]

Kiszka J., 2023, Debugging kernel and modules via GDB

[8]

Lazar A., 2021, KVMi subsystem v7 for KVM. KVM mailing list

[9]

Lengyel T.K., 2016, Stealthy monitoring with xen altp2m

[10] A Survey of Security Issues in Hardware Virtualization [J].

Pek, Gabor ;

Buttyan, Levente ;

Bencsath, Boldizsar .

ACM COMPUTING SURVEYS, 2013, 45 (03)

← 1 2 →