OS OS OS VMI (Virutal Machine Introspection)[1] OS VMI OS OS OS OS I/O OS API OS OS OS OS OS OS Windows OS OS OS OS syslog OS Windows OS Xen KVM

Size: px

Start display at page:

Download "OS OS OS VMI (Virutal Machine Introspection)[1] OS VMI OS OS OS OS I/O OS API OS OS OS OS OS OS Windows OS OS OS OS syslog OS Windows OS Xen KVM"

しょうこかわらい
5 years ago
Views:

1 , OS OS OS OS External Storage Mechanism for Preserving File Access Log with Virtualization Technology Ruo Ando 1 Masaki Hashimoto 2 Toshihiro Yamauchi 3 Received: May 14, 2012, Accepted: November 5, 2012 Abstract: Recently, it is more important to grasp and control the damage of attacks safely, so much research has been done to increase the security of the general-purpose OS by observing the behavior using virtualization technology. In this paper, we propose a mechanism to observe and logging the file access in guest OS from virtual machine monitor using the inter-domain communication by the filter driver. Our mechanism can be applied independently of the implementation of virtual machine monitor. By hooking file accesses in the guest OS, log messages are transferred and stored to the virtual machine monitor, so our approach is effective from the viewpoint of preservation of the log. We show the design and implementation of our mechanism for both Xen and KVM. Furthermore, we report the results of measuring the performance when accessing files as evaluation National Institute of Information and Communications Technology 2 Graduate School of Information Security, Institute of Information Security 3 Graduate School of Natural Science and Technology, Okayama University c 2013 Information Processing Society of Japan 1

2 OS OS OS VMI (Virutal Machine Introspection)[1] OS VMI OS OS OS OS I/O OS API OS OS OS OS OS OS Windows OS OS OS OS syslog OS Windows OS Xen KVM VMI VMI 2.1 c 2013 Information Processing Society of Japan 2

3 Xen[2] KVM[3] VMware[4] Windows 7 (XP )[5] OS Xen Split Kernel Driver XenAccess[6] Split Kernel Driver blktap shype[7] RBAC[8], [9] TE[10] MLS[11], [12], [13] OS OS Windows OS Windows Windows OS VMI Garfinkel [1] VMI VMI Volatality[14] Revirt[15] Lares[16] Xenprobes[17] VMScope[18] (in-the-box) (out-of-the-box) 2 [19] *2 [20] Volatility Xen Split Kernel Driver Xen Revirt Volatility Patagonix[21] Lares Patagonix Lares Lares Quynh[22] King [23] King *2 c 2013 Information Processing Society of Japan 3

4 OS Windows OS OS OS 2.3 Windows OS OS Windows OS OS OS 2.2 Patagonix Lares OS OS API OS Volatility Revirt OS OS ( i ) ( ii ) OS (i) ( iii )(ii) OS Windows OS (XP,Vista,7) OS OS VM EXIT OS c 2013 Information Processing Society of Japan 4

5 Filter Driver send start length of string one character c[i] and i send end Fig. 1 1 Mini Filter send start length of string one character c[i] and i send end Interrupt Handler in VMM allocate buffer store character output string Host OS Inter-domain communication protocol output IA-32 OS OS OS Windows OS Xen KVM OS 4 OS Windows Microsoft Microsoft I/O intermediate driver Windows Microsoft Zw API OS VM EXIT OS 1 test string "test string" -> 74, 45, 73, 74, 20, 73, 74, 72, 69, 6E, EAX asm{ mov eax, 74 } OS VM Linux Linux Linux Windows OS c 2013 Information Processing Society of Japan 5

6 2 Application Fig. 2 Write Requst(PRE ) Write Complete Filter Manager Interdomain Communication Write Request ipost) File System Write Request (PRE) Write Request(commit ) Write Complete Disk Windows OS File Access using Filter Manager in Windows OS type FLT_PREOP_CALLBACK_STATUS function Obtains file information structure Control file access Returns value for file access arg 1 PFLT_CALLBACK_DATA Data 2 PCFLT_RELATED_OBJECTS FltObjects 3 PVOID *CompletionContext return 1 FLT_PREOP_SUCCESS_WITH_CALLBACK (succeed) 2 FLT_PREOP_SUCCESS_NO_CALLBACK (succeed) 3 FLT_PREOP_COMPLETE (succeed/fail) failure 3 Fig. 3 Return: FLT_PREOP_COMPLETE Set Data->IoStatus.Statuserror I/O Structure for the Callback Status of I/O Operation 4. OS OS Windows OS Xen KVM 4.1 Xen Linux KVM Xen 0 OS OS KVM Linux Linux Xen VMI Xen KVM [20] OS Windows 7 SP1 CREATE, CLOSE, CLEANUP, READ, WRITE SET INFORMATION 6 ID typedef struct _FILE_ACCESS_DATA{ BOOLEAN IsDirectory; UNICODE_STRING FullPath; ULONG AccessRecord; ULONG AccessAttributes; ULONG ProcessID; PWCHAR ProcessName; ULONG ProcessAttributes; } FILE_ACCESS_DATA, *PFILE_ACCESS_DATA; 2 PreRead PreWrite FullPath, ProcessID, ProcessName 4.2 Windows OS Windows OS Windows OS 2 Write Request (PRE) PRE POST 3 I/O May 3 08:58:21 localhost kernel: [log][vm1] ;filerw;prewrite;11;40;processid;1112;svcho- ST.EXE;C:\WINDOWS\PREFETCH\NET1.EXE-029B9DB4.PF May 3 08:58:25 localhost kernel: [log][vm1] ;filerw;preread;11;40;processid;1988;wmicl- ISV.EX;C:\WINDOWS\SYSTEM32\DRIVERS\ETC\HOSTS.PF May 3 08:58:21 SVCHOST.EXE( 1112) C:\WINDOWS\PREFETCH\NET1.EXE- 029B9DB4.PF (PreWrite) c 2013 Information Processing Society of Japan 6

7 Windows OS Userland Windows OS userland Process Process Filter Driver Filter Driver asm(mov E*X*) asm(mov E*X*) Host OS (Linux) emit 0x** Host OS (Linux) asm(mov DR* *) File Access Log Windows Kernelland File Access Log Windows kernelland XM dmesg buffer NTFS Driver system log NTFS Driver Virtual Machine Monitor Hypercall Handler Fetch vcpu context E*X Virtual Machine Monitor Debug Register Handler Fetch vcpu context E*X Log Composer Activate Log Composer Call / Activate DR* 4 Xen 5 KVM Fig. 4 Implementation on Xen Fig. 5 Implementation on KVM 4.3 Xen KVM OS 4 5 Windows OS Filter Driver Xen 4 Xen Windows OS VM EXIT Xen Xen KVM Linux do hvm hypercall OS(domain0) Xen int hvm_do_hypercall (struct cpu_user_regs *regs) do hvm hypercall hvm.c OS VM EXIT vcpu CPU OS OS Xen KVM 5 KVM Windows OS vcpu Windows OS VM EXIT x86 DR0 DR6 dr handler OS 5. Xen KVM 5.1 blaster sassar avserve2.exe Windows OS Windows OS May 3 09:00:25 localhost kernel: [log][vm1]; filerw;preread;136;processid;4032;avserve2. exe;hkey_local_machine\system\controlset001 c 2013 Information Processing Society of Japan 7

8 \Services\Tcpip\ParametersDomain Windows OS 5.2 ( ) KVM Xen I/O Intel(R) Core(TM)2 Duo CPU (1.6GHz) 3.40GB I/O Windows OS Logical/Physical I/O Linux (Linux tar.gz) / 3 Disk I/O Avg Disk Bytes/Transfer Avg. Disk Bytes/Write Windows OS Windows 7 XP KVM Linux qemu Xen paravirt kernel Write/Transfer 2 / KVM Xen 12 KVM Xen Xen / 2 3 Disk I/O KVM Garfinkel [1] VM rootkit i) ii) VM EXIT iii) 3 VM 2.2 Secure In-VM Monitoring[20] Sharif VM CR3 MSR(model specific register) VM OS VM 690% (7 ) Sharif 13.7% Sharif CR3 MSR 13.7% 2 KVM 2%Xen 8% Sharif 5.5 Windows OS c 2013 Information Processing Society of Japan 8

9 1 / 3 Disk I/O Table 1 Performance Measurements of Disk I/O with/without Filter Driver item filter bare KVM Xen Avg Disk Bytes/Transfer no driver 4,230, ,501, ,693, Avg Disk Bytes/Transfer driver 3,590, ,439, ,540, Avg Disk Bytes/Write no driver 4,207, ,371, ,789, Avg Disk Bytes/Write driver 3,568, ,274, ,501, Disk I/O Table 2 Decreasing Rate in Disk I/O Performance with Filter Driver item bare KVM Xen Avg Disk Bytes/Transfer Avg Disk Bytes/Write Microsoft [24] % 15% 20% Win32/Msblast Win32/Sassar Win32/Rbot Win32/Sdbot rootkit rootkit VM 1 API API API VM Microsoft API Microsoft I/O c 2013 Information Processing Society of Japan 9

10 6. Windows OS OS API OS ( Windows OS) OS 2.3 OS [1] T. GARFINKEL. A virtual machine introspection based architecture for intrusion detection. In Proc. of Network and Distributed Systems Security Symposium, 2003, pp , [2] Paul Barham, Boris Dragovic, Keir Fraser, Steven Hand, Tim Harris, Alex Ho, Rolf Neugebauer, Ian Pratt, and Andrew Warfield. Xen and the art of virtualization. SIGOPS Oper. Syst. Rev., Vol. 37, pp , October [3] A. Kivity, Y. Kamay, D. Laor, U. Lublin, and A. Liguori. kvm: the linux virtual machine monitor. In Proceedings of the Linux Symposium, Vol. 1, pp , [4] Carl A. Waldspurger. Memory resource management in vmware esx server. SIGOPS Oper. Syst. Rev., Vol. 36, pp , December [5] Microsoft Corporation. Microsoft windows. [6] B.D. Payne. Xenaccess: An introspection library for xen, [7] R. Sailer, E. Valdez, T. Jaeger, R. Perez, L. Van Doorn, J.L. Griffin, and S. Berger. shype: Secure hypervisor approach to trusted virtualized systems. IBM Research Report RC23511, [8] D. Ferraiolo, J. Cugini, and D.R. Kuhn. Role-based access control (RBAC): Features and motivations. In Proceedings of 11th Annual Computer Security Application Conference, pp , [9] D. Ferraiolo and R. Kuhn. Role-Based Access Control. In In 15th NIST-NCSC National Computer Security Conference, [10] J Tidswell and J Potter. An approach to dynamic domain and type enforcement. Lecture Notes in Computer Science, Vol. 1270, pp , [11] D.E. Bell and L.J. LaPadula. Secure computer systems: mathematical foundations and model. Technical Report M74-244, The MITRE Corporation, Bedford, MA, [12] K. J. Biba. Integrity considerations for secure computer systems. Technical Report MTR-3153, The MITRE Corporation, Bedford, MA, [13] DD Clark and DR Wilson. A comparison of commercial and military computer security models. In Proceedings of the IEEE Computer Society Symposium on Security and Privacy, pp IEEE Computer Society, [14] Volatile Systems, LLC. Volatility memory forensics volatile systems. [15] George W. Dunlap, Samuel T. King, Sukru Cinar, Murtaza A. Basrai, and Peter M. Chen. Revirt: enabling intrusion analysis through virtual-machine logging and replay. SIGOPS Oper. Syst. Rev., Vol. 36, pp , c 2013 Information Processing Society of Japan 10

11 December [16] B.D. Payne, M. Carbone, M. Sharif, and W. Lee. Lares: An architecture for secure active monitoring using virtualization. In Security and Privacy, SP IEEE Symposium on, pp IEEE, [17] Nguyen Anh Quynh and Kuniyasu Suzaki. Xenprobes, a lightweight user-space probing framework for xen virtual machine. In 2007 USENIX Annual Technical Conference on Proceedings of the USENIX Annual Technical Conference, pp. 2:1 2:14, Berkeley, CA, USA, USENIX Association. [18] Lee Breslau, Chris Chase, Nick Duffield, Bill Fenner, Yanhua Mao, and Subhabrata Sen. Vmscope: a virtual multicast vpn performance monitor. In Proceedings of the 2006 SIGCOMM workshop on Internet network management, INM 06, pp , New York, NY, USA, ACM. [19] Peter M. Chen and Brian D. Noble. When virtual is better than real. In Proceedings of the Eighth Workshop on Hot Topics in Operating Systems, pp. 133, Washington, DC, USA, IEEE Computer Society. [20] Monirul I. Sharif, Wenke Lee, Weidong Cui, and Andrea Lanzi. Secure in-vm monitoring using hardware virtualization. In Proceedings of the 16th ACM conference on Computer and communications security, CCS 09, pp , New York, NY, USA, ACM. [21] L. Litty, H.A. Lagar-Cavilla, and D. Lie. Hypervisor support for identifying covertly executing binaries. In Proceedings of the 17th conference on Security symposium, pp USENIX Association, [22] N.A. Quynh, R. Ando, and Y. Takefuji. Centralized security policy support for virtual machine. In USENIX, 20th Large Installation System Administration Conference, [23] S.T. King, G.W. Dunlap, and P.M. Chen. Debugging operating systems with time-traveling virtual machines. In Proceedings of the annual conference on USENIX Annual Technical Conference, pp USENIX Association, [24] Microsoft Corporation IEEE ISS DC ACM USENIX 2006 c 2013 Information Processing Society of Japan 11

クラウド環境におけるWindows ゲストの完全性検証技術

クラウド環境におけるWindows ゲストの完全性検証技術 TCG 技術を使った研究クラウド環境におけるWindows ゲストの完全性検証技術情報通信研究機構情報通信セキュリティ研究センター安藤類央はじめにクラウドコンピューティングの普及 Amazon EC2, hybrid cloud 遠隔環境の安全性 (integrity)の検証遠隔地にあるサーバは