Full Program »
Efficient Protection of Kernel Data Structures via Object Partitioning
dynamically allocated at runtime. Our hypervisor-based design uses memory page protection bits as part of its policy enforcement. The granularity difference between page-level protection and variablelevel policies challenges the system’s ability to remain performant. In another contribution, we develop kernel data-layout partitioning
and reorganization techniques to maintain kernel performance in the presence of our protections. We show that our system can prevent malicious modifications to security-critical kernel data with small overhead. By offering protection for critical kernel data structures,
we can detect unknown kernel-level malware and guarantee that security utilities relying on the integrity of kernel-level state remain accurate.
AT&T Labs -- Research
Georgia Institute of Technology