Hormuzd M. Khosravi

Dynamic service deployment in a distributed heterogeneous cluster based router (DHCR)

This paper presents the design, implementation and evaluation of an extensible, scalable and distributed heterogeneous cluster based programmable router, called DHCR (Distributed Heterogeneous Cluster based Router), capable of supporting and deploying network services at run time. DHCR is a software IP router relying on heterogeneous cluster composed of separated computers with different hardware and software architecture capabilities, running different operating systems and interconnected through a high speed network connection. The DHCR ensures dynamic deployment of services and distributed control of router components (forwarding and routing elements) over heterogeneous system environments. The DHCR combines the IETF ForCES (Forwarding and Control Element Separation) architecture with software component technologies to meet the requirements of the next generation software routers. To ensure reliable and transparent communication between separated, decentralized and heterogeneous router components, the CORBA based middleware technology is used to support the DHCR internal communication. The paper also explores the use of the CORBA Component Model (CCM) to design and implement a modular, distributed and heterogeneous forwarding path for the DHCR router architecture. The CCM based forwarding plane ensures dynamic reconfiguration of the data path topology needed for low-level service deployment. Results on achievable performance using the proposed DHCR router are reported.

RKRD: Runtime Kernel Rootkit Detection

In this paper we address the problem of protecting computer systems against stealth malware. The problem is important because the number of known types of stealth malware increases exponentially. Existing approaches have some advantages for ensuring system integrity but sophisticated techniques utilized by stealthy malware can thwart them. We propose Runtime Kernel Rootkit Detection (RKRD), a hardware-based, event-driven, secure and inclusionary approach to kernel integrity that addresses some of the limitations of the state of the art. Our solution is based on the principles of using virtualization hardware for isolation, verifying signatures coming from trusted code as opposed to malware for scalability and performing system checks driven by events. Our RKRD implementation is guided by our goals of strong isolation, no modifications to target guest OS kernels, easy deployment, minimal infra-structure impact, and minimal performance overhead. We developed a system prototype and conducted a number of experiments which show that the per-formance impact of our solution is negligible.