Hypervisor Based Integrity: Protect Guest Kernel in Cloud
summary
Proposal enforces runtime kernel integrity by loading a signed guest kernel module at boot that sends memory ranges to the hypervisor, which applies EPT/NPT enforcement and VM-exit checks on MSRs and control registers; a prototype uses a new hypercall/API to handshake with VMM, shows rare EPT violations (mostly legit kernel hotpatch paths), minimal steady-state overhead, and options to kill-and-dump or log on violations. Requires minor kernel layout changes and Intel support for hypervisor-managed linear address translation.
AI-written summary · about
chapters (16)
- 0:00Google Cloud
- 0:40Disclaimer
- 0:57Background
- 3:39Threat Model
- 4:02Protect the guest kernel at runtime
- 6:02Why hypervisor as another security layer?
- 8:36Overall Plan - Boot Time: Guest
- 9:39Overall Plan - Boot Time: Hypervisor
- 10:14Overall Plan - Run Time
- 11:50Performance Impact
- 13:10Technical challenges
- 14:31Example
- 15:27Changes needed for KVM/QEMU
- 20:38For the Future
- 21:32Other security considerations
- 24:52Summary
related talks
39mHeki: Hypervisor-Enforced Kernel Integrity for Linux with KVM
41mHypervisor-Enforced Kernel Integrity (Heki) for KVM
32mLVBS and Advanced Kernel Integrity
47mLinux Virtualization Based Security
25mProtecting from MaliciousHypervisor Using AMD SEV-SNP
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments
20mExtending OpenPOWER Boot Security to Guests
20mHardening Linux guest kernel for CC