Abstract:For the ability to explore the memory's fullest potential, memory de-duplication has been widely experimented with in current main stream virtualization platforms. A lot of work has been done to improve the efficiency of memory de-duplication, while too little attention was paid to the introduced security issues which have been proved by prior work. To deal with this security risk and efficiently manage the memory we start our work in this paper. We first conduct extensive experiments on different OS platforms to study the realistic situation of page sharing. By analyzing the results we find: 1) Page sharing is contributed mostly by self-sharing (nearly 90%), and the self-sharing rate varies significantly between Linux and Windows OS platforms. Compared with self-sharing the inter-VM sharing rate is extremely low, under 1% in most cases. 2) Page size has a larger influence on Linux platform than Windows platform, so sub-page de-duplication proposed in prior work may achieve better performance on Linux platform. On the basis of above findings we propose a group-based secure page sharing model (or GSKSM), in which we consider both VM processes and normal processes. We have successfully implemented it in Linux kernel 3.6.6, and the experiment results show it works well with negligible overhead. Finally based on GSKSM we further present an efficient memory management approach (or SEMMA), which combines GSKSM and balloon technique to efficiently manage the memory, and the preliminary experiment result is satisfactory.

Verifying the Safety of Xen Security Modules

Applying Rely-Guarantee Reasoning on Concurrent Memory Management and Mailbox in μC/OS-II: A Case Study.

Applying Rely-Guarantee Reasoning on Concurrent Memory Management and Mailbox in C/OS-II: A Case Study

Explore Xen Security Mechanism

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

Ensuring secure and robust grid applications – from a formal method point of view

An Approach for Secure-Communication Between XEN Virtual Machines

SeVMM: VMM-Based Security Control Model

HyperCheck: A Hardware-AssistedIntegrity Monitor

The Application of Virtual Machines on System Security

Identification and Evaluation of Sharing Memory Covert Timing Channel in Xen Virtual Machines

Toward the Verification of a Simple Hypervisor

SEMMA: Secure Efficient Memory Management Approach in Virtual Environment.

Commercial hypervisor-based task sandboxing mechanisms are unsecured? But we can fix it!

A Think on Security and Trusty Measurement for Virtualized Environment

Apply Formal Methods in Certifying the SyberX High-Assurance Kernel

Approach of Kernel Integrity Monitoring Using Hardware Virtualization

Secure System Virtualization: End-to-End Verification of Memory Isolation

On the effectiveness of virtualization-based security

From Wireless Sensor Networks to Wireless Body Area Networks: Formal Modeling and Verification on Security Using PAT.

Preventing Secret Data Leakage from Foreign Mappings in Virtual Machines