New Client Virtualization Usage Models Using IntelŴVirtualization Technology

Ramachandran, Mahendra

doi:10.1535/itj.1003.04

Cited by 3 publications

(3 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Intel has proposed a secure client virtual machine monitor (VMM) architecture [3], in which two guest operating systems execute on a VT-x-based VMM called LVMM. Network communication and memory accesses in one guest are monitored by a program running on the other.…”

Section: A Hypervisors For Securitymentioning

confidence: 99%

See 1 more Smart Citation

Using a Hypervisor to Migrate Running Operating Systems to Secure Virtual Machines

Tsutomu

Oyama

Eiraku³

et al. 2010

2010 IEEE 34th Annual Computer Software and Applications Conference

View full text Add to dashboard Cite

We propose HyperShield, which is a hypervisor that can be inserted into and removed from a running operating system, for improving security. While many existing securityoriented hypervisors require modifying or rebooting an overlying operating system, HyperShield does not require this. HyperShield is intended to be a general framework for various security mechanisms. The current implementation provides two mechanisms for preventing kernel-level buffer overflow. One detects the execution of user code with the kernel privilege, and the other detects malicious modification of a return address in a control stack. HyperShield is implemented on Linux as a loadable kernel module. When the module is inserted, it places itself under the operating system and executes as a hypervisor. The operating system is migrated into a virtual machine and managed by the hypervisor. HyperShield detects attacks by combining virtualization of memory management with a hardware-assisted execution-bit feature. We have confirmed through experiments that HyperShield successfully prevented kernel-level buffer overflow attacks.

show abstract

Section: A Hypervisors For Securitymentioning

confidence: 99%

“…Network communication and memory accesses in one guest are monitored by a program running on the other. However, whether LVMM can be inserted into a running operating system is not mentioned in [3]. NICKLE [7] is a VMM-based system that prevents the execution of unauthorized kernel code.…”

Section: A Hypervisors For Securitymentioning

confidence: 99%

Using a Hypervisor to Migrate Running Operating Systems to Secure Virtual Machines

Tsutomu

Oyama

Eiraku³

et al. 2010

2010 IEEE 34th Annual Computer Software and Applications Conference

View full text Add to dashboard Cite

show abstract

“…LVMM [22] uses a VMM that runs two VMs on desktop machines: a user partition VM for running a standard desktop operating system and a services partition VM for a small management operating system. LVMM allows the the user partition VM to directly handle most devices except for an NIC device.…”

Section: Related Workmentioning

confidence: 99%

BitVisor

Shinagawa

Eiraku

Tanimoto

et al. 2009

Proceedings of the 2009 ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments

130

View full text Add to dashboard Cite

Virtual machine monitors (VMMs), including hypervisors, are a popular platform for implementing various security functionalities. However, traditional VMMs require numerous components for providing virtual hardware devices and for sharing and protecting system resources among virtual machines (VMs), enlarging the code size of and reducing the reliability of the VMMs. This paper introduces a hypervisor architecture, called parapassthrough, designed to minimize the code size of hypervisors by allowing most of the I/O access from the guest operating system (OS) to pass-through the hypervisor, while the minimum access necessary to implement security functionalities is completely mediated by the hypervisor. This architecture uses device drivers of the guest OS to handle devices, thereby reducing the size of components in the hypervisor to provide virtual devices. This architecture also allows to run only single VM on it, eliminating the components for sharing and protecting system resources among VMs.We implemented a hypervisor called BitVisor and a parapassthrough driver for enforcing storage encryption of ATA devices based on the parapass-through architecture. The experimental result reveals that the hypervisor and ATA driver require approximately 20 kilo lines of code (KLOC) and 1.4 KLOC respectively.

show abstract

I/O processing in a virtualized platform

Chadha

Illiikkal

Iyer

et al. 2007

Proceedings of the 3rd International Conference on Virtual Execution Environments

View full text Add to dashboard Cite

Virtualization provides levels of execution isolation and service partition that are desirable in many usage scenarios, but its associated overheads are a major impediment for wide deployment of virtualized environments. While the virtualization cost depends heavily on workloads, it has been demonstrated that the overhead is much higher with I/O intensive workloads compared to those which are compute-intensive. Unfortunately, the architectural reasons behind the I/O performance overheads are not well understood. Early research in characterizing these penalties has shown that cache misses and TLB related overheads contribute to most of I/O virtualization cost. While most of these evaluations are done using measurements, in this paper we present an executiondriven simulation based analysis methodology with symbol annotation as a means of evaluating the performance of virtualized workloads. This methodology provides detailed information at the architectural level (with a focus on cache and TLB) and allows designers to evaluate potential hardware enhancements to reduce virtualization overhead. We apply this methodology to study the network I/O performance of Xen (as a case study) in a full system simulation environment, using detailed cache and TLB models to profile and characterize software and hardware hotspots. By applying symbol annotation to the instruction flow reported by the execution driven simulator we derive function level call flow information. We follow the anatomy of I/O processing in a virtualized platform for network transmit and receive scenarios and demonstrate the impact of cache scaling and TLB size scaling on performance.

show abstract

New Client Virtualization Usage Models Using IntelŴVirtualization Technology

Cited by 3 publications

References 0 publications

Using a Hypervisor to Migrate Running Operating Systems to Secure Virtual Machines

Using a Hypervisor to Migrate Running Operating Systems to Secure Virtual Machines

BitVisor

I/O processing in a virtualized platform

Contact Info

Product

Resources

About