KIMS: Kernel Integrity Measuring System based on TrustZone

Android operating system has been getting widely used in these years. At the meantime, lots of security issues have been exposed. Not only the softwares running on it are suffering great losses, but the operating system itself is also becoming a target for attackers. Especially kernel-level rootkits have a bad influence on the system security. Some attackers can use this method to get the root privilege by exploiting these vulnerabilities. It's high time we should take measures to enhance protection for Android kernel. In this paper, we propose a kernel integrity measuring system named KIMS on the TrustZone Architecture. The key idea is to build a safe and isolated environment for kernel measuring provided by the secure world in the TrustZone. And with the high privilege of secure world, KIMS can monitor the operating system kernel and detect whether it is destroyed. Then we build the prototype using the Hikey960 board to evaluate our design. The experiments show that our system can execute kernel integrity measurement when a malicious behaviour detected. And it has a relatively small performance overhead.