SSdetector: Secure and Manageable Host-based IDS with SGX and SMM

Host-based intrusion detection systems (HIDS) are used to monitor the internals of target systems. It is essentially difficult to execute HIDS securely inside target systems. For example, it is not guaranteed that HIDS can obtain correct information from compromised systems. If HIDS is tampered with by intruders, it would be easily disabled. So far, various techniques have been proposed to securely execute HIDS using the security features of processors, e.g., System Management Mode (SMM) and SGX in Intel processors. However, strongly secure HIDS sacrifices its manageability, whereas manageable HIDS is less secure. In practice, it is important to achieve not only the security but also the manageability of HIDS. This paper proposes SSdetector for achieving both security and manageability by combining SGX and SMM. SSdetector securely runs HIDS inside an SGX enclave, which is a protected region inside an SGX application. Since HIDS is developed as an SGX application, the management of HIDS is easier. To securely obtain system information in memory, in-enclave HIDS invokes the SMM monitor running in an isolated execution environment created by BIOS. SSdetector protects information passed between in-enclave HIDS and the SMM monitor by encryption and integrity checking. We have implemented SSdetector in UEFI BIOS and examined the performance of HIDS collecting system information necessary for the proc filesystem.