EPA-RIMM : an Efficient, Performance-Aware Runtime Integrity Measurement Mechanism for Modern Server Platforms
Published In
2019 49th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
Document Type
Citation
Publication Date
6-1-2019
Abstract
Detecting unexpected changes in a system's runtime environment is critical to resilience. A repurposing of System Management Mode (SMM) for runtime security inspections has been proposed, due to SMM's high privilege and protected memory. However, key challenges prevent SMM's adoption for this purpose in production-level environments: the possibility of severe performance impacts, semantic gaps between SMM and host software, high overheads, overly broad access permissions, and lack of flexibility. We introduce a Runtime Integrity Measurement framework, EPA-RIMM, for both native Linux and Xen platforms, that includes several novel features to solve these challenges. EPA-RIMM decomposes large measurements to control perturbation and leverages the SMI Transfer Monitor (STM) to bridge the semantic gap between hypervisors and SMM, as well as restrict the measurement agent's accesses. We present a design and implementation for a concurrent approach that allows EPA-RIMM to utilize all cores in SMM, dramatically increasing measurement throughput and reducing application perturbation. Our Linux and Xen prototype results show that EPA-RIMM meets performance goals while continuously monitoring code and data for signs of attack, and that it is effective at detecting a number of recent exploits.
Locate the Document
DOI
10.1109/DSN.2019.00051
Persistent Identifier
https://archives.pdx.edu/ds/psu/34754
Publisher
IEEE
Citation Details
Delgado, B., Vibhute, T., Fastabend, J., & Karavanic, K. (2019). EPA-RIMM : An Efficient, Performance-Aware Runtime Integrity Measurement Mechanism for Modern Server Platforms. Institute of Electrical and Electronics Engineers (IEEE). https://doi.org/10.1109/dsn.2019.00051