A Secure Framework for Monitoring Operating Systems Using SPEs in Cell/B.E.

Recently, even operating systems are often compromised by the attackers. Since a compromised operating system affects all the applications including security software on top of it, the integrity of the operating system should be guaranteed. However, it is difficult to monitor the operating system securely. In this paper, we propose SPE Observer, which is a framework for securely monitoring operating systems using SPEs in Cell/B.E. SPE Observer guarantees the integrity and confidentiality of monitoring systems by the isolation mode of SPEs. To complement the isolation mode, SPE Observer monitors the running status of monitoring systems from an external security proxy. In addition, it schedules monitoring systems to mitigate the performance degradation of applications due to occupying SPEs. We have implemented SPE Observer in PlayStation 3 and developed the integrity monitor of the operating system. According to our experiments, it was shown that the integrity monitor on an SPE could detect a compromised operating system and that the application performance was dramatically improved by scheduling the integrity monitor.