Virtual Ghost: protecting applications from hostile operating systems

摘要

Operating systems are very complex, with millions of lines of code; in general, they cannot be proven secure. They may contain malware, or they may have been compromised by attackers. This means that, in many cases, they cannot be trusted. Protecting applications against attacks coming from the operating system requires elaborate solutions, and several approaches have been presented. Virtual Ghost, the new system presented in this paper, is based on compiler instrumentation and runtime checks. This approach effectively inserts a small hardware abstraction layer between the kernel and the hardware providing operations to be used by the kernel to manipulate hardware, and provides some trusted services for secure applications. Virtual Ghost runs as a regular library at the same privilege level as the kernel. The paper discusses the architectural aspects of Virtual Ghost and shows how it can handle all types of attacks by an operating system on applications. The performance analysis of a prototype shows reasonable overhead for providing this level of security to applications and to the kernel itself.