Security for the Xen Hypervisor Status Quo & Perspective 2006

Size: px

Start display at page:

Download "Security for the Xen Hypervisor Status Quo & Perspective 2006"

Melinda Richardson
5 years ago
Views:

1 Security for the Xen Hypervisor Status Quo & Perspective 2006 Reiner Sailer Xen Summit 2006 IBM T J Watson Research Center 1/17/2006

2 1. Access Control Module 2. Virtual Trusted Platform Module 2 IBM T J Watson Research Center 1/17/2006

3 Hypervisor Security Architecture / ACM Major Goal: Create distributed confined operating environments Allow controlled sharing between domains, building coalitions of domains and virtual peripherals Why: To better protect distributed services / workloads How: Xen/ACM confinement serving as a Universal foundation for OS security Safety net if OS security fails or is missing 3 IBM T J Watson Research Center 1/17/2006

4 Policy Support Status Quo Simple Type Enforcement Policy Controls which domains can share [Coalitions for Domains] Chinese Wall Policy Controls which domains can run simultaneously on the same system [Approximated Air-Gap between Domains] 4 IBM T J Watson Research Center 1/17/2006

5 Layers of Isolation and Sharing Granularity OS/MLS (bridges coalitions) Human Coalition Resources e.g. Data Base Payroll Files shype (controls sharing) Virt. Res. Xen VMM (virtualizes + isolates) VMs Xen Core Hypervisor Layer HW 5 IBM T J Watson Research Center 1/17/2006

6 Simple Type Enforcement Policy (STE) Example: 3 Coalitions Yellow, Blue, Green VM VBD Guest Kernel Guest Kernel Guest Kernel Guest Kernel Guest Kernel Hypervisor/sHype ACM ACM Xen / shype Hardware 6 IBM T J Watson Research Center 1/17/2006

7 Sharing of HW Devices Through Isolated Virtual Devices shype coalition isolation no stronger than MAC OS Isolation Create isolated virtual devices to prevent overprovisioning VM 1 MAC VM 2 Xen/sHype controls which VM can connect to MAC VM M A C M A C ACM Xen/sHype defers MAC enforcement to MAC-OS Xen/sHype can provide access control decisions Xen/sHype 7 IBM T J Watson Research Center 1/17/2006

8 Perspective 2006 Access Control Module Encourage Security Community to Build on top of Xen/ACM Policy (e.g., SELinux/MLS) Extending Access Control Enforcement onto virtual peripheral devices (VBD, V-NIF) Extending Access Control across multiple platforms 8 IBM T J Watson Research Center 1/17/2006

9 Challenges Security Adds to Trend of Refactoring Dom0 Refactoring of Domain0 Essential It s too large (LOC) no (strong) guarantees possible It s too powerful no confinement in case of error It s ever changing very hard to stay non-intrusive Driver aka Device aka MAC Domains Small domains own hardware and create isolated virtual peripherals that can be assigned to different coalitions (assumes IO-MMU) 9 IBM T J Watson Research Center 1/17/2006

10 1. Access Control Module 2. Virtual Trusted Platform Module 10 IBM T J Watson Research Center 1/17/2006

11 Dom-0 Dom-U Hypervisor TPM 11 IBM T J Watson Research Center 1/17/2006 TPM TPM TPM TPM Virtual TPM Support in Xen TPM BE Dom-U Dom-U TPM FE TPM FE TPM FE Dom-U TPM FE

12 Perspective Virtual TPM vtpm drivers in close co-operation with Intel Migration support for domains with vtpm Intel driving authenticated boot Minimal startup partition to initialize the access control and vtpm environment Measuring Xen components Co-operation with AMD on dynamic root of trust Attestation support for domains (IMA) 12 IBM T J Watson Research Center 1/17/2006

13 Summary Policy and enforcement in Xen is stable Labeling and policy enforcement for virtual VM resources continuing (network + VBD) Extending shype across multiple platforms continuing vtpm support expanding (dynamic root of trust) Security Requirements add to the Trend of Refactoring Domain0 13 IBM T J Watson Research Center 1/17/2006

14 Available Xen/ACM Security Tools Policy Management Interface (Web-based) Command line policy translation tools (xml policies Xen/ACM binary policies) Labeling tools (setlabel, getlabel) IBM LTC: Tom Lendacky IBM Research: Stefan Berger, Reiner Sailer 14 IBM T J Watson Research Center 1/17/2006

CSE543 - Computer and Network Security Module: Virtualization

CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system