NDLI: HyperSentry: enabling stealthy in-context measurement of hypervisor integrity

Please wait, while we are loading the content...

Security analysis of India's electronic voting machines

HyperSentry: enabling stealthy in-context measurement of hypervisor integrity

A methodology for empirical analysis of permission-based security models and its application to android

Building efficient fully collusion-resilient traitor tracing and revocation schemes

Testing metrics for password creation policies by attacking large sets of revealed passwords

Robusta: taming the native beast of the JVM

Modeling attacks on physical unclonable functions

An empirical study of privacy-violating information flows in JavaScript web applications

In search of an anonymous and secure lookup: attacks on structured peer-to-peer anonymous communication systems

Abstraction by set-membership: verifying security protocols and web services with databases

AccessMiner: using system-centric models for malware protection

TASTY: tool for automating secure two-party computations

On the (in)security of IPsec in MAC-then-encrypt configurations

Mimimorphism: a new approach to binary code obfuscation

Symbolic security analysis of ruby-on-rails web applications

A privacy recommendation wizard for users of social networking sites

Enhancing resilience of probabilistic key pre-distribution schemes for WSNs through hash chaining

Dissecting one click frauds

Trail of bytes: efficient support for forensic analysis

Mobile location tracking in metro areas: malnets and others

Algebraic pseudorandom functions with improved efficiency from the augmented cascade

The security of modern password expiration: an algorithmic framework and empirical analysis

Retaining sandbox containment despite bugs in privileged memory-safe code

Dismantling SecureMemory, CryptoMemory and CryptoRF

DIFC programs by automatic instrumentation

Recruiting new tor relays with BRAIDS

Developing security protocols by refinement

Input generation via decomposition and re-stitching: finding bugs in Malware

Worry-free encryption: functional encryption with public keys

On the soundness of authenticate-then-encrypt: formalizing the malleability of symmetric encryption

Platform-independent programs

Sidebuster: automated detection and quantification of side-channel leaks in web application development

SecTag: a multi-policy supported secure web tag framework

TAPS: automatically preparing safe SQL queries

@spam: the underground on 140 characters or less

Survivable key compromise in software update systems

On pairing constrained wireless devices based on secrecy of auxiliary channels: the case of acoustic eavesdropping

Practical leakage-resilient pseudorandom generators

Attacks and design of image recognition CAPTCHAs

A control point for reducing root abuse of file-system privileges

Attacking and fixing PKCS#11 security tokens

Predictive black-box mitigation of timing channels

An improved algorithm for tor circuit scheduling

Computational indistinguishability logic

Inference and analysis of formal models of botnet command and control protocols

Synchronized aggregate signatures: new definitions, constructions and applications

A new framework for efficient password-based authenticated key exchange

Return-oriented programming without returns

NoTamper: automatic blackbox detection of parameter tampering opportunities in web applications

Demonstrating cognitive packet network resilience to worm attacks

XACML policy performance evaluation using a flexible load testing framework

PinDr0p: using single-ended audio features to determine call provenance

Practical leakage-resilient identity-based encryption from simple assumptions

Dissent: accountable anonymous group messaging

Computationally sound verification of source code

BLADE: an attack-agnostic approach for preventing drive-by malware infections

Secure text processing with applications to private DNA matching

Accountability: definition and relationship to verifiability

DieHarder: securing the heap

Protecting browsers from cross-origin CSS attacks

In God we trust all others we monitor

Protecting portable storage with host validation

Virtual browser: a web-level sandbox to secure third-party JavaScript without sacrificing functionality

CardSpace in the cloud

Secure latency estimation with treeple

TEE: a virtual DRTM based execution environment for secure cloud-end computing

Laptop theft: a case study on the effectiveness of security mechanisms in open organizations

Information security for sensors by overwhelming random sequences and permutations

On verifying stateful dataflow processing services in large-scale cloud systems

Assessing trust in uncertain information using Bayesian description logic

Timing attacks on PIN input devices

Detecting and characterizing social spam campaigns

Fingerprinting websites using remote traffic analysis

Efficient sensor node authentication via 3GPP mobile communication networks

Rendezvous tunnel for anonymous publishing

Exploiting social networking sites for spam

An implementation of event and filter confidentiality in pub/sub systems and its application to e-health

Privacy and robustness for data aggregation in wireless sensor networks

Designing router scheduling policies: a privacy perspective

CRAFT: a new secure congestion control architecture

Dialog-based payload aggregation for intrusion detection

Protecting location privacy against inference attacks

Designs to account for trust in social network-based sybil defenses

Secure encounter-based social networks: requirements, challenges, and designs

Secure online banking on untrusted computers

iFriendU: leveraging 3-cliques to enhance infiltration attacks in online social networks

Losing control of the internet: using the data plane to attack the control plane

Size-based scheduling: a recipe for DDOS?

User-friendly matching protocol for online social networks

Hierarchical attribute-based encryption for fine-grained access control in cloud storage services

Secure dynamic code generation against spraying

Ad hoc broadcast encryption

Dynamic window based multihop authentication for WSN

Spectrum based fraud detection in social networks

A portable TPM based on USB key

On efficient ciphertext-policy attribute based encryption and broadcast encryption: extended abstract

Efficient provable data possession for hybrid clouds

A cloud based SIM DRM scheme for the mobile internet

HyperSentry: enabling stealthy in-context measurement of hypervisor integrity

Content Provider	ACM Digital Library
Author	Wang, Zhi Jiang, Xuxian Zhang, Xiaolan Skalsky, Nathan C. Ning, Peng Azab, Ahmed M.
Abstract	This paper presents HyperSentry, a novel framework to enable integrity measurement of a running hypervisor (or any other highest privileged software layer on a system). Unlike existing solutions for protecting privileged software, HyperSentry does not introduce a higher privileged software layer below the integrity measurement target, which could start another race with malicious attackers in obtaining the highest privilege in the system. Instead, HyperSentry introduces a software component that is properly isolated from the hypervisor to enable stealthy and in-context measurement of the runtime integrity of the hypervisor. While stealthiness is necessary to ensure that a compromised hypervisor does not have a chance to hide the attack traces upon detecting an up-coming measurement, in-context measurement is necessary to retrieve all the needed inputs for a successful integrity measurement. HyperSentry uses an out-of-band channel (e.g., Intelligent Platform Management Interface (IPMI), which is commonly available on server platforms) to trigger the stealthy measurement, and adopts the System Management Mode (SMM) to protect its base code and critical data. A key contribution of HyperSentry is the set of novel techniques that overcome SMM's limitation, providing an integrity measurement agent with (1) the same contextual information available to the hypervisor, (2) completely protected execution, and (3) attestation to its output. To evaluate HyperSentry, we implement a prototype of the framework along with an integrity measurement agent for the Xen hypervisor. Our experimental evaluation shows that HyperSentry is a low-overhead practical solution for real world systems.
Starting Page	38
Ending Page	49
Page Count	12
File Format	PDF
ISBN	9781450302456
DOI	10.1145/1866307.1866313
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2010-10-04
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Integrity measurement Virtualization Hypervisor integrity
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in