HIMA: A Hypervisor-Based Integrity Measurement Agent

Azab, Ahmed M.; Ning, Peng; Sezer, Emre Can; Zhang, Xiaolan

doi:10.1109/acsac.2009.50

Cited by 82 publications

(61 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Hence, Terra provides integrity checking only at boot time and no runtime protection. A better approach is given by [22], called HIMA (Hypervisor-based Integrity Measurement Agent), which can be also combined with Terra; a similar approach is described in Section 6. In HIMA, "out-of-the-box" measurement is done by active monitoring of critical guest events (e.g., creation of a process) and guest memory protection (by using hardware support, e.g., NX-bit).…”

Section: Related Workmentioning

confidence: 99%

“…This can be achieved by hardware support. For example, in HIMA (Hypervisor-based Integrity Measurement Agent) [22], this is done by the No-eXecute (NX) bit page protection flag, which is available on most hardware platforms. Executing an instruction from a page that is protected by the NX flag will cause an exception that is trapped in the hypervisor.…”

Section: System Integrity Checkingmentioning

confidence: 99%

See 1 more Smart Citation

A Secure System Architecture for Measuring Instruments in Legal Metrology

et al. 2015

View full text Add to dashboard Cite

Embedded systems show the tendency of becoming more and more connected. This fact combined with the trend towards the Internet of Things, from which measuring instruments are not immune (e.g., smart meters), lets one assume that security in measuring instruments will inevitably play an important role soon. Additionally, measuring instruments have adopted general-purpose operating systems to offer the user a broader functionality that is not necessarily restricted towards measurement alone. In this paper, a flexible software system architecture is presented that addresses these challenges within the framework of essential requirements laid down in the Measuring Instruments Directive of the European Union. This system architecture tries to eliminate the risks general-purpose operating systems have by wrapping them, together with dedicated applications, in secure sandboxes, while supervising the communication between the essential parts and the outside world.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: System Integrity Checkingmentioning

confidence: 99%

A Secure System Architecture for Measuring Instruments in Legal Metrology

et al. 2015

View full text Add to dashboard Cite

show abstract

“…Azab and colleagues proposed a hypervisor-based agent (HIMA) that lived inside a hypervisor to measure the integrity of the guest virtual machines running the host [1]. HIMA provides active monitoring to the important guest VM event, as well as memory protection of guest VMs to ensure the correctness of the integrity measurement.…”

Section: State-of-the-art Approachesmentioning

confidence: 99%

A Pre-Kernel Agent Platform for security assurance

Lee

Rahimi

Harvey

2011

2011 IEEE Symposium on Intelligent Agent (IA)

View full text Add to dashboard Cite

Abstract-Without the security assurance from the underlining operating system, software agents and agencies are constantly under security threats through the operating system. Although the security issues between software agents and agencies have been studied intensively, any formulated counter-measurement of these issues are subject to attacks that are able to exploit the vulnerabilities of the operating system kernel (OS kernel). To protect agents and agencies against such risks, we proposed a novel approach that isolates the OS kernel and limit modifications to the agency system in the physical memory space. Our approach utilizes a hypervisor to create a virtualized environment for the operating system. The agency is then loaded into physical memory and injected into the operating system of the host without any interactions from the OS kernel. All memory access requests are monitored and managed by our approach to prevent unauthorized modification from the OS kernel and maintain the integrity of the agency system. Furthermore, any agent migrated to the host can be encrypted by our approach to prevent any alterations from the OS kernel. The encryption key is safely shared between the agency system and the hypervisor by utilizing part of the memory space of the agency as a communication interface. Consequently, our approach is able to limit the security threats that exploit the vulnerability of the operating system to the agency systems as well as ensure the integrity of both agents and agencies. This study describes the formulation and implementation of the proposed platform that can securely deploy agent agent systems to the host and effectively control access to host devices.

show abstract

“…The integrity measurement is a way to prove that the providers and sources are reliable and accountability, that means the software files have not been damaged or tampered. The researchers from IBM propose the HIMA [17] which also employs a VMMbased approach to take integrity measurements on user programs and kernel codes. However, HIMA needs modification to the guest OS.…”

Section: Trusted Loadingmentioning

confidence: 99%

CyberGuarder: A virtualization security assurance architecture for green cloud computing

et al. 2012

Future Generation Computer Systems

129

View full text Add to dashboard Cite

HIMA: A Hypervisor-Based Integrity Measurement Agent

Cited by 82 publications

References 12 publications

A Secure System Architecture for Measuring Instruments in Legal Metrology

A Secure System Architecture for Measuring Instruments in Legal Metrology

A Pre-Kernel Agent Platform for security assurance

CyberGuarder: A virtualization security assurance architecture for green cloud computing

Contact Info

Product

Resources

About