Hardware assisted hypervisor introspection

Hardware assisted hypervisor introspection

In this paper, we introduce hypervisor introspection, an out-of-box way to monitor the execution of hypervisors. Similar to virtual machine introspection which has been proposed to protect virtual machines in an out-of-box way over the past decade, hypervisor introspection can be used to protect hypervisors which are the basis of cloud security. Virtual machine introspection tools are usually d...

A Hypervisor IPS based on Hardware assisted Virtualization Technology

Hypervisor Introspection: A Technique for Evading Passive Virtual Machine Monitoring

Security requirements in the cloud have led to the development of new monitoring techniques that can be broadly categorized as virtual machine introspection (VMI) techniques. VMI monitoring aims to provide high-fidelity monitoring while keeping the monitor secure by leveraging the isolation provided by virtualization. This work shows that not all hypervisor activity is hidden from the guest vir...

System Introspection with Hardware Watchmachines

Unfortunately, current introspection mechanisms usually impose a high performance overhead or are difficult for programmers to use. For example, a 1000x slowdown using Valgrind for application debugging is not uncommon, and the lack of precise instruction counters has complicated research in deterministic multiprocessing [1, 7, 2]. However, with careful hardware support, introspection can be ma...

Hardware-Assisted On-Demand Hypervisor Activation for Efficient Security Critical Code Execution on Mobile Devices

As more and more mobile applications need to run security critical codes (SCCs) for secure transactions and critical information handling, the demand for a Trusted Execution Environment (TEE) to ensure safe execution of SCCs is rapidly escalating. Although a number of studies have implemented TEEs using TrustZone or hypervisors and have evinced the effectiveness in terms of security, they face ...