SKEE: A Lightweight Secure Kernel-level Execution Environment for ARM.
Ahmed M. Azab,Kirk Swidowski,Rohan Bhutkar,Jia Ma,Wenbo Shen,Ruowen Wang,Peng Ning
DOI: https://doi.org/10.14722/ndss.2016.23009
2016-01-01
Abstract:Previous research on kernel monitoring and protection widely relies on higher privileged system components, such as hardware virtualization extensions, to isolate security tools from potential kernel attacks.These approaches increase both the maintenance effort and the code base size of privileged system components, which consequently increases the risk of having security vulnerabilities.SKEE, which stands for Secure Kernellevel Execution Environment, solves this fundamental problem.SKEE is a novel system that provides an isolated lightweight execution environment at the same privilege level of the kernel.SKEE is designed for commodity ARM platforms.Its main goal is to allow secure monitoring and protection of the kernel without active involvement of higher privileged software.SKEE provides a set of novel techniques to guarantee isolation.It creates a protected address space that is not accessible to the kernel, which is challenging to achieve when both the kernel and the isolated environment share the same privilege level.SKEE solves this challenge by preventing the kernel from managing its own memory translation tables.Hence, the kernel is forced to switch to SKEE to modify the system's memory layout.In turn, SKEE verifies that the requested modification does not compromise the isolation of the protected address space.Switching from the OS kernel to SKEE exclusively passes through a well-controlled switch gate.This switch gate is carefully designed so that its execution sequence is atomic and deterministic.These properties combined guarantee that a potentially compromised kernel cannot exploit the switching sequence to compromise the isolation.If the kernel attempts to violate these properties, it will only cause the system to fail without exposing the protected address space.SKEE exclusively controls access permissions of the entire OS memory.Hence, it prevents attacks that attempt to inject unverified code into the kernel.Moreover, it can be easily extended to intercept other system events in order to support various intrusion detection and integrity verification tools.This paper presents a SKEE prototype that runs on both 32-bit ARMv7 and 64-bit ARMv8 architectures.Performance evaluation results demonstrate that SKEE is a practical solution for real world systems.1 These authors contributed equally to this work I. INTRODUCTIONMany of the current commodity operating systems, like Linux, Windows, and FreeBSD, rely on monolithic kernels, which store security and access control policies in memory regions that are accessible to their whole code base.Hence, the security of the whole system relies on a large Trusted Computing Base (TCB) that includes the base kernel code in addition to potentially buggy device drivers.An exploit of a monolithic kernel would allow complete access to the entire system memory and resources.In addition, it can effectively bypass kernel level security protection mechanisms.Recent incidents [1], [2], [5], [28], [32], [53] show that exploiting the OS kernel is a real threat.Hence, there is a need for security tools that provide monitoring and protection of the kernel.These tools have to be properly isolated so that they are protected from potential kernel exploitation.