Abstract:The prevalence of Cloud Computing has appealed many users to put their business into low-cost and flexible cloud servers instead of bare-metal machines. Most virtual machines in the cloud run commodity operating system(e.g., linux), and the complexity of such operating systems makes them more bug-prone and easier to be compromised. To mitigate the security threats, previous works attempt to mediate and filter system calls, transform all unpopular paths into popular paths, or implement a nested kernel along with the untrusted outter kernel to enforce certain security policies. However, such solutions only enforce read-only protection or assume that popular paths in the kernel to contain almost no bug, which is not always the case in the real world. To overcome their shortcomings and combine their advantages as much as possible, we propose a hardware-assisted isolation mechanism that isolates untrusted part of the kernel. To achieve isolation, we prepare multiple restricted Extended Page Table (EPT) during boot time, each of which has certain critical data unmapped from it so that the code executing in the isolated environment could not access sensitive data. We leverage the VMFUNC instruction already available in recent Intel processors to directly switch to another pre-defined EPT inside guest virtual machine without trapping into the underlying hypervisor, which is faster than the traditional trap-and-emulate procedure. The semantic gap is minimized and real-time check is achieved by allowing EPT violations to be converted to Virtualization Exception (VE), which could be handled inside guest kernel in non-root mode. Our preliminary evaluation shows that with hardware virtualization feature, we are able to run the untrusted code in an isolated environment with negligible overhead.

Vcerberus: A DRTM System Based on Virtualization Technology

Cerberus: A Novel Hypervisor to Provide Trusted and Isolated Code Execution

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

Trusted Computing Base Using Virtualization Platform

Undertow: an Intra-Kernel Isolation Mechanism for Hardware-Assisted Virtual Machines.

Barrier: a Lightweight Hypervisor for Protecting Kernel Integrity Via Memory Isolation.

(Mostly) Exitless VM Protection from Untrusted Hypervisor Through Disaggregated Nested Virtualization.

Pcanel/V2: A VMM Architecture Based on Intel VT-x

A Light-Weight, Secure and Trusted Virtual Execution Environment

Detangling Resource Management Functions From The Tcb In Privacy-Preserving Virtualization

A Protective Mechanism for the Access Control System in the Virtual Domain

Cloudvisor: Retrofitting Protection Of Virtual Machines In Multi-Tenant Cloud With Nested Virtualization

Cherub: Fine-Grained Application Protection with On-Demand Virtualization

Trusted Lightweight VMM Based Security Architecture

Enhanced Privilege Separation for Commodity Software on Virtualized Platform

Security and Performance in the Delegated User-level Virtualization

On the effectiveness of virtualization-based security

A Kernel Integrity Protection Technology Based on Virtual Machine

Vtz: Virtualizing ARM TrustZone.

Transparent Driver-Kernel Isolation with VMM Intervention

Virtualizing System and Ordinary Services in Windows-based OS-Level Virtual Machines