Vedvyas Shanbhogue
Intel Corporation
VIS:Virtualization-based Integrity Services
******
Malicious software is increasingly using stealth techniques, motivated
by financial rewards. Advanced stealth techniques tamper with in-memory
execution state of critical services such as drivers as well as OS
kernel as well. We describe an implementation of VIS
(Virtualization-based Integrity Services) on Xen that leverages memory
virtualization to allow protection of software components running in a
HVM managed by Xen. The software components are measured once and
protected during their execution lifetime within the guest linear
address space. The paper will describe the modifications to the page
table shadowing algorithm to apply VIS protections, and the methods by
which tamper on protected code/data can be detected and prevented.