基于ARM虚拟化扩展的Android内核动态度量方法  

Dynamic measurement of Android kernel based on ARM virtualization extension

作　　者：路子聪 徐开勇[1] 郭松 肖警续 LU Zicong;XU Kaiyong;GUO Song;XIAO Jingxu(Information Engineering University,Zhengzhou Henan 450000,China)

机构地区：[1]信息工程大学,郑州450000

出　　处：《计算机应用》2018年第9期2644-2649,共6页journal of Computer Applications

基　　金：国家重点研发计划项目(2016YFB0501900;2017YFB0801900)~~

摘　　要：针对现阶段内核级攻击对Android系统完整性的威胁,提出一种基于ARM虚拟化扩展的Android内核动态度量方法 DIMDroid。该方法利用ARM架构中的硬件辅助虚拟化技术,提供度量模块与被度量Android系统的隔离,首先通过分析在Android系统运行时影响内核完整性的因素从而得到静态和动态度量对象,其次在度量层对这些度量对象进行语义重构,最后对其进行完整性分析来判断Android内核是否受到攻击;同时通过基于硬件信任链的启动保护和基于内存隔离的运行时防护来保证DIMDroid自身安全。实验结果表明,DIMDroid能够及时发现破环Android内核完整性的rootkit,且该方法的性能损失在可接受范围内。Aiming at the integrity threat of Android systems at present brought by kernel-level attacks,a method for dynamic measurement of Android kernel,namely DIMDroid(Dynamic Integrity Measurement of Android),was proposed.The hardware-assisted virtualization technology was used to provide the isolation between the measurement module and the measured Android system.First of all,the static and dynamic measurement objects were obtained by analyzing the kernel elements that affect kernel integrity in the running of the Android system.Secondly,these measurement objects were semantically reconstructed at the measurement layer.Finally,an integrity analysis was performed to determine whether the Android kernel is under attack or not.At the same time,the boot protection based on hardware-based trust chain and the runtime protection based on memory isolation were performed to ensure the security of DIMDroid itself.The experimental results show that DIMDroid can detect the rootkit which breaks Android kernel integrity in time,and the performance loss of the method is within an acceptable range.

关 键 词：ARM硬件虚拟化 Android内核 动态完整性度量 内核级攻击 HYPERVISOR 

分 类 号：TP316.81[自动化与计算机技术—计算机软件与理论]