DMCA
Isolating Commodity Hosted Hypervisors with HyperLock (2012)
| Venue: | In Proceedings of the 7th ACM SIGOPS/EuroSys European Conference on Computer Systems |
| Citations: | 13 - 2 self |
BibTeX
@INPROCEEDINGS{Wang12isolatingcommodity,
author = {Zhi Wang and Chiachih Wu and Michael Grace and Xuxian Jiang},
title = {Isolating Commodity Hosted Hypervisors with HyperLock},
booktitle = {In Proceedings of the 7th ACM SIGOPS/EuroSys European Conference on Computer Systems},
year = {2012}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Hosted hypervisors (e.g., KVM) are being widely deployed. One key reason is that they can effectively take advantage of the mature features and broad user bases of commodity oper-ating systems. However, they are not immune to exploitable software bugs. Particularly, due to the close integration with the host and the unique presence underneath guest virtual machines, a hosted hypervisor – if compromised – can also jeopardize the host system and completely take over all guests in the same physical machine. In this paper, we present HyperLock, a systematic ap-proach to strictly isolate privileged, but potentially vul-nerable, hosted hypervisors from compromising the host OSs. Specifically, we provide a secure hypervisor isolation runtime with its own separated address space and a restricted instruction set for safe execution. In addition, we propose another technique, i.e., hypervisor shadowing, to efficiently create a separate shadow hypervisor and pair it with each guest so that a compromised hypervisor can affect only the paired guest, not others. We have built a proof-of-concept HyperLock prototype to confine the popular KVM hypervisor on Linux. Our results show that HyperLock has a much smaller (12%) trusted computing base (TCB) than the original KVM. Moreover, our system completely removes QEMU, the companion user program of KVM (with> 531K SLOC), from the TCB. The security experiments and performance measurements also demonstrated the practical-ity and effectiveness of our approach.
Keyphrases
commodity hosted hypervisors virtual machine exploitable software bug hosted hypervisors unique presence underneath restricted instruction mature feature secure hypervisor isolation runtime host os systematic ap-proach physical machine compromised hypervisor commodity oper-ating system proof-of-concept hyperlock prototype host system companion user program performance measurement security experiment hypervisor shadowing broad user base close integration popular kvm hypervisor separate shadow hypervisor paired guest separated address space key reason safe execution original kvm
