H-KPP: Hypervisor-Assisted Kernel Patch Protection

Michael Kiperberg; Nezer Jacob Zaidenberg

doi:10.3390/app12105076

H-KPP: Hypervisor-Assisted Kernel Patch Protection

Michael Kiperberg, Nezer Jacob Zaidenberg

Research output: Contribution to journal › Article › peer-review

2 Scopus citations

Abstract

We present H-KPP, hypervisor-based protection for kernel code and data structures. H-KPP prevents the execution of unauthorized code in kernel mode. In addition, H-KPP protects certain object fields from malicious modifications. H-KPP can protect modern kernels equipped with BPF facilities and loadable kernel modules. H-KPP does not require modifying or recompiling the kernel. Unlike many other systems, H-KPP is based on a thin hypervisor and includes a novel SLAT switching mechanism, which allows H-KPP to achieve very low (≈ 6%) performance overhead compared to baseline Linux.

Original language	English
Article number	5076
Journal	Applied Sciences (Switzerland)
Volume	12
Issue number	10
DOIs	https://doi.org/10.3390/app12105076
State	Published - 1 May 2022
Externally published	Yes

Keywords

DKOM
Kernel Integrity
virtualization

Access to Document

10.3390/app12105076

Cite this

@article{d7be46c39b7f432f90e1083bc2f0e1e6,

title = "H-KPP: Hypervisor-Assisted Kernel Patch Protection",

abstract = "We present H-KPP, hypervisor-based protection for kernel code and data structures. H-KPP prevents the execution of unauthorized code in kernel mode. In addition, H-KPP protects certain object fields from malicious modifications. H-KPP can protect modern kernels equipped with BPF facilities and loadable kernel modules. H-KPP does not require modifying or recompiling the kernel. Unlike many other systems, H-KPP is based on a thin hypervisor and includes a novel SLAT switching mechanism, which allows H-KPP to achieve very low (≈ 6%) performance overhead compared to baseline Linux.",

keywords = "DKOM, Kernel Integrity, virtualization",

author = "Michael Kiperberg and Zaidenberg, {Nezer Jacob}",

note = "Publisher Copyright: {\textcopyright} 2022 by the authors. Licensee MDPI, Basel, Switzerland.",

year = "2022",

month = may,

day = "1",

doi = "10.3390/app12105076",

language = "אנגלית",

volume = "12",

journal = "Applied Sciences (Switzerland)",

issn = "2076-3417",

publisher = "MDPI Multidisciplinary Digital Publishing Institute",

number = "10",

}

TY - JOUR

T1 - H-KPP

T2 - Hypervisor-Assisted Kernel Patch Protection

AU - Kiperberg, Michael

AU - Zaidenberg, Nezer Jacob

PY - 2022/5/1

Y1 - 2022/5/1

N2 - We present H-KPP, hypervisor-based protection for kernel code and data structures. H-KPP prevents the execution of unauthorized code in kernel mode. In addition, H-KPP protects certain object fields from malicious modifications. H-KPP can protect modern kernels equipped with BPF facilities and loadable kernel modules. H-KPP does not require modifying or recompiling the kernel. Unlike many other systems, H-KPP is based on a thin hypervisor and includes a novel SLAT switching mechanism, which allows H-KPP to achieve very low (≈ 6%) performance overhead compared to baseline Linux.

AB - We present H-KPP, hypervisor-based protection for kernel code and data structures. H-KPP prevents the execution of unauthorized code in kernel mode. In addition, H-KPP protects certain object fields from malicious modifications. H-KPP can protect modern kernels equipped with BPF facilities and loadable kernel modules. H-KPP does not require modifying or recompiling the kernel. Unlike many other systems, H-KPP is based on a thin hypervisor and includes a novel SLAT switching mechanism, which allows H-KPP to achieve very low (≈ 6%) performance overhead compared to baseline Linux.

KW - DKOM

KW - Kernel Integrity

KW - virtualization

UR - http://www.scopus.com/inward/record.url?scp=85130935494&partnerID=8YFLogxK

U2 - 10.3390/app12105076

DO - 10.3390/app12105076

M3 - ???researchoutput.researchoutputtypes.contributiontojournal.article???

AN - SCOPUS:85130935494

SN - 2076-3417

VL - 12

JO - Applied Sciences (Switzerland)

JF - Applied Sciences (Switzerland)

IS - 10

M1 - 5076

ER -

H-KPP: Hypervisor-Assisted Kernel Patch Protection

Abstract

Keywords

Access to Document

Other files and links

Fingerprint

Cite this