Abstract: Kernel-level attacks compromise operating system security by tampering with critical data and control flow in the kernel. Current approaches defend against these attacks by applying code integrity or control flow integrity control methods. However, they focus on only a certain aspect and cannot give a complete integrity monitoring solution. This paper analyzed the kernel integrity principle and got practical rectuirements to ensure kernel integrity. Critical data objects effect operating system function directly. Only certain code is able to modify critical data objects at certain condidons to ensure data integrity. All factors about code execution sequence are protected and monitored to ensure control flow integrity. Implementation in Xen VMM(Virtual Machine Monitor) using hardware virtualization,or referred to as HVM(Hardware Virtual Machine) is introduced to protect and monitor Linux kernel. Experiments show that the solution can detect and prevent attacks and bugs compromising the kernel.

Key words: Monitor, VMM, HVM, Control flow integrity, Data integrity