# H-KPP: Hypervisor-Assisted Kernel Patch Protection
## 6 Related Work  
The main goal of hardware-assisted virtualization is the execution of multiple operating systems on a single hardware, as demonstrated by VirtualBox [21], VMware Workstation [22], Xen [23]. However, since its first introduction more than a decade ago, it has also been used for the construction of secure applications. The applications cover a wide range of security areas. For example, Nitro [24], and its extension DRAKVUF [25], are Xen-based hypervisors for system call interception. They work by intercepting the system call mechanism of the x86 architecture, thus providing an OS-independent framework for virtual machine introspection (VMI). In particular, DRAKVUF introduces the notion of a stealth breakpoint for the interception of kernel functions. H-KPP uses a similar approach for intercepting the do_jit function, for example. Another example is SBCFI [26]. SBCFI is a Xen-based hypervisor that provides control flow integrity verification for the underlying operating system. Currently, H-KPP does not include control flow hijacking countermeasures. However, it can be extended along the lines of SBCFI. Moreover, in theory, H-KPP's performance should be better due to its minimalistic design. BitVisor [9] is a thin hypervisor that intercepts access to ATA hard disks to enforce storage encryption. A thin hypervisor is a preferred solution for security applications due to its low overhead compared to a full hypervisor. Like BitVisor, H-KPP is based on a thin hypervisor but provides different security services, namely protecting the kernel's code and data. SecVisor [27] is another thin hypervisor that uses a secondary-level address translation (SLAT) and IOMMU to prevent unauthorized code execution in kernel mode. H-KPP is similar to SecVisor in its secondary-level address translation tables configuration. H-KPP differs from SecVisor in three aspects. Firstly, H-KPP introduces a new approach for rapid switching between two SLAT configurations, using code injection and the special VMFUNC instruction. This approach significantly improves the system performance. While it is difficult to make a direct comparison, we can see that SecVisor's performance in all the test cases was worse than Xen's, a full hypervisor. In contrast, H-KPP's performance is much better than VirtualBox's, which is also a full hypervisor. Secondly, unlike SecVisor, H-KPP can handle just-in-time generated code of BPFs. Thirdly, H-KPP protects the kernel's data structures and kernel's code protection. [PERSON] et al. [28] proposed a system that prevents the execution of unauthorized code in user mode. This system is also based on a thin hypervisor. Unlike H-KPP, the system proposed by [PERSON] et al. targets user mode applications and therefore makes unrealistic assumptions about the kernel mode execution. In particular, it assumes that the kernel modules are compiled statically into the kernel and that the BPF mechanism is disabled. \begin{table}
\begin{tabular}{l l l l} \hline \hline
**Verification Type** & **Time (ns)** & **Objects** & **Time Per Object (ns)** \\ \hline Hashing Interrupt Descriptor Table & 6046 & 256 & 23 \\ Hashing System Call Table & 5408 & 447 & 12 \\ inode.f\_op field & 8,432,219 & 118,425 & 71 \\ file\_operation objects & 171,802 & 154 & 1115 \\ XYZ\_seq\_ops structures & 3852 & 4 & 962 \\ Set equality task\_struct & 138,312 & 297 & 465 \\ Single Reference task\_struct.cred & 72,250 & 297 & 243 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Verification time. However, the ideas presented by [PERSON] et al. can be integrated into H-KPP, thus allowing it to protect the execution of user mode applications and the kernel. [PERSON] et al. [29] proposed a similar system for the Windows OS. PrivGuard [30] is a lightweight system for protecting kernel objects. PrivGuard is based on stack canaries and object duplication verifications performed during system calls. H-KPP is similar to PrivGuard in its protection of the task_struct.cred field.