Pioneer: verifying code integrity and enforcing untampered code execution on legacy systems

We propose a primitive, called Pioneer, as a first step towards verifiable code execution on untrusted legacy hosts. Pioneer does not require any hardware support such as secure co-processors or CPUarchitecture extensions. We implement Pioneer on an Intel Pentium IV Xeon processor. Pioneer can be used as a basic building block to build security systems. We demonstrate this by building a kernel rootkit detector. Categories and Subject Descriptors: Software, Operating Systems, Security and Protection, Verification. General Terms: Security.

• Type: Conference
• Year: 2005
• Where: SOSP
• Authors: Arvind Seshadri, Mark Luk, Elaine Shi, Adrian Perrig, Leendert van Doorn, Pradeep K. Khosla
• Keywords: Basic Building Block, Kernel Rootkit Detector, Operating System, Pentium IV Xeon, SOSP 2005