STM/PE & XHIM. Eugene D. Myers Trust Mechanisms Information Assurance Research NSA/CSS Research Directorate May 24, 2018
|
|
|
- Brent Lindsey
- 5 years ago
- Views:
Transcription
1 STM/PE & XHIM Eugene D. Myers Trust Mechanisms Information Assurance Research NSA/CSS Research Directorate May 24, 2018
2 Overview SMM STM STM/PE XHIM, an STM/PE application Future Plans
3 System Management Mode (SMM) X86 Processor Mode Entered via an SMI - Cannot be blocked - Brings all CPUs into SMM - Entry is invisible to the O/S Executes in SMRAM -Area defined by chipset & processor -Protected from I/O and non-smm access Exited via RSM instruction
4 SMM Dual Monitor Treatment VTX added Dual Monitor Treatment SMM root-vm is a peer to the ring-0 root-vm Two possible methods of entry VMCALL (root-vm only) SMI Translated to a VMEXIT to the SMM root-vm Interrupted/calling VM becomes the guest-vm
5 SMI Transfer Monitor (STM) Simple Hypervisor VMCS Switcher SMI-handler now runs in a guest-vm Restricted by the VM protections Manages the security policy to restrict the SMI handler s access - In coordination with the O/S
6 STM Protection provided by VT-x - Page Tables Protection provided by H/W - Chipset SMI Handler VM-guest X X Linux VM-guest VM-guest STM VM-root X VMM VM-root Hardware SMI Transfer Monitor (STM)
7 STM/PE Overview Protected Execution (PE) STM/PE NSA mods to a stock STM XHIM Dynamic integrity measurer Current Status and Future Plans
8 Protected Execution Execution that cannot be viewed external to the container By OS Other processors Executing a VM in SMM where that VM is located in SMRAM can provide this
9 STM/PE SMI Handler VM-guest PE/VM Measurement Agent VM-guest PE/VM Temporary Module VM-guest Linux VM-guest Linux VM-guest STM/PE VM-root VMM VM-root Shared Memory Hardware
10 Dell STM STM/PE based on Developed by Dell for NSA as a POC Intel Reference STM Open-source (On github) Includes instructions to add STM support to TianoCore BIOS Info at: firmware.intel.com
11 Protected Execution Support Security-PE module access is restricted by explicit permissions vice BIOS centric model used in STM spec PE/VMs will not have access to I/O, MSRs etc. Allowed access only to specific areas in memory.
12 STM/PE Gotchas O/S support is necessary to deal with the disappearance of a processor This true of any technology where the CPU goes into a different mode without telling the O/S Q: Is it possible to have a feature for the O/S to learn this w/o thinking that there is a failure
13 XHIM, an STM/PE application Based on LKIM Linux Kernel Integrity Measurer KIM Engine is core to LKIM Linux XHIM XEN (Protected by STM/PE) WinKIM Windows 10 Dynamic Integrity Measurement
14 Dynamic Integrity Measurement Does not rely on signatures Characterizes how legitimate software is supposed to behave Software behaves in very predictable ways according to its source code Malware often changes kernel state in a manner that is inconsistent with the kernel s source code Identifies any deviation as malicious / bug
15 KIM detects two kinds of attacks Kernel code injection Kernel control flow attacks Implants cause inconsistent system state KIM detects the inconsistent state Can detect the effects resulting from a Zero Day Can also detect bugs
16 XHIM and STM/PE XHIM is a permanent PE module STM/PE protects XHIM from interference by other elements in the system Access to system memory is limited to: r/w region to pass back results and XEN kernel memory (r/o) for scanning
17 Starting XHIM XHIM Starts by either a vmcall from ring-0 (debug) SMI timer interrupt (production) In this case, XHIM is loaded during XEN setup Currently, runs in this mode on development box every 16 seconds
18 XHIM Current Status Incorporated into LKIM source tree Updated to current LKIM version Utilizes the hardware state information provided by the STM CR3 (page table pointer) Active VMCS s (Virtual Machine Control Structure) Baselining streamlined
19 STM/XHIM Support Current Status Both on-demand and timer execution Provides processor state info for all processors Provides VMCS layout info Calculates this information on initial request Clears XHIM heap before each execution reset hashable known state for each run
20 Future STM/PE and XHIM is basis for our internal pilot Will use Open-XT Will be incorporated into a larger measurement appraisal management system WinKIM and LKIM will measure Windows and Linux VMs respectively Run a virtual TPM (vtpm) in a temporary PE/VM Soon to be open sourced
21 Questions
Intel s Virtualization Extensions (VT-x) So you want to build a hypervisor?
Intel s Virtualization Extensions (VT-x) So you want to build a hypervisor? Mr. Jacob Torrey May 13, 2014 Dartmouth College 153 Brooks Road, Rome, NY 315.336.3306 http://ainfosec.com @JacobTorrey torreyj@ainfosec.com
An Introduction to Platform Security
presented by An Introduction to Platform Security Spring 2018 UEFI Seminar and Plugfest March 26-30, 2018 Presented by Brent Holtsclaw and John Loucaides (Intel) Legal Notice No computer system can be
Micro VMMs and Nested Virtualization
Micro VMMs and Nested Virtualization For the TCE 4th summer school on computer security, big data and innovation Baruch Chaikin, Intel 9 September 2015 Agenda Virtualization Basics The Micro VMM Nested
Scotch: Combining Software Guard Extensions and System Management Mode to Monitor Cloud Resource Usage
Scotch: Combining Software Guard Extensions and System Management Mode to Monitor Cloud Resource Usage Kevin Leach 1, Fengwei Zhang 2, and Westley Weimer 1 1 University of Michigan, 2 Wayne State University
Junhong Jiang, Kevin Tian, Chris Wright, Don Dugger
Updating Xen for the Client Environment Junhong Jiang, Kevin Tian, Chris Wright, Don Dugger Legal Content INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. EXCEPT AS PROVIDED
Virtually Impossible
Virtually Impossible The Reality of Virtualization Security Gal Diskin / Chief Research Officer / Cyvera LTD. /WhoAmI? Chief Research Officer @ Cvyera LTD Formerly Security Evaluation Architect of the
Past, Present, and Future Justin Johnson Senior Principal Firmware Engineer
Dell Firmware Security Past, Present, and Future Justin Johnson Senior Principal Firmware Engineer justin.johnson1@dell.com Dell Security 2 What does BIOS do? Configure and Test System Memory Configure
CS-580K/480K Advanced Topics in Cloud Computing. VM Virtualization II
CS-580K/480K Advanced Topics in Cloud Computing VM Virtualization II 1 How to Build a Virtual Machine? 2 How to Run a Program Compiling Source Program Loading Instruction Instruction Instruction Instruction
Introduction to SGX (Software Guard Extensions) and SGX Virtualization. Kai Huang, Jun Nakajima (Speaker) July 12, 2017
Introduction to SGX (Software Guard Extensions) and SGX Virtualization Kai Huang, Jun Nakajima (Speaker) July 12, 2017 1 INTEL RESTRICTED SECRET Agenda SGX Introduction Xen SGX Virtualization Support Backup
OS Security IV: Virtualization and Trusted Computing
1 OS Security IV: Virtualization and Trusted Computing Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab2 More questions? 3 Virtual machine monitor +-----------+----------------+-------------+
Virtual Machine Virtual Machine Types System Virtual Machine: virtualize a machine Container: virtualize an OS Program Virtual Machine: virtualize a process Language Virtual Machine: virtualize a language
Operating System Security
Operating System Security Operating Systems Defined Hardware: I/o...Memory.CPU Operating Systems: Windows or Android, etc Applications run on operating system Operating Systems Makes it easier to use resources.
Virtualization. Pradipta De
Virtualization Pradipta De pradipta.de@sunykorea.ac.kr Today s Topic Virtualization Basics System Virtualization Techniques CSE506: Ext Filesystem 2 Virtualization? A virtual machine (VM) is an emulation
VT-d Posted Interrupts. Feng Wu, Jun Nakajima <Speaker> Intel Corporation
VT-d Posted Interrupts Feng Wu, Jun Nakajima Intel Corporation Agenda Motivation Difference btw CPU-based and VT-d Posted Interrupts Architecture Implementation Details Performance Summary 2
Virtual Machines. Part 2: starting 19 years ago. Operating Systems In Depth IX 1 Copyright 2018 Thomas W. Doeppner. All rights reserved.
Virtual Machines Part 2: starting 19 years ago Operating Systems In Depth IX 1 Copyright 2018 Thomas W. Doeppner. All rights reserved. Operating Systems In Depth IX 2 Copyright 2018 Thomas W. Doeppner.
Making Nested Virtualization Real by Using Hardware Virtualization Features
Making Nested Virtualization Real by Using Hardware Virtualization Features May 28, 2013 Jun Nakajima Intel Corporation 1 Legal Disclaimer INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL
Virtualization. Operating Systems, 2016, Meni Adler, Danny Hendler & Amnon Meisels
Virtualization Operating Systems, 2016, Meni Adler, Danny Hendler & Amnon Meisels 1 What is virtualization? Creating a virtual version of something o Hardware, operating system, application, network, memory,
COMPUTER ARCHITECTURE. Virtualization and Memory Hierarchy
COMPUTER ARCHITECTURE Virtualization and Memory Hierarchy 2 Contents Virtual memory. Policies and strategies. Page tables. Virtual machines. Requirements of virtual machines and ISA support. Virtual machines:
AMD SEV Update Linux Security Summit David Kaplan, Security Architect
AMD SEV Update Linux Security Summit 2018 David Kaplan, Security Architect WHY NOT TRUST THE HYPERVISOR? Guest Perspective o Hypervisor is code I don t control o I can t tell if the hypervisor is compromised
HP Sure Start Gen3. Table of contents. Available on HP Elite products equipped with 7th generation Intel Core TM processors September 2017
Technical white paper Gen3 7th generation Intel Core TM processors September 2017 Table of contents 1 Gen3... 2 1.1 Background... 2 1.2 Gen3 overview... 2 1.3 Runtime Intrusion Detection (RTID)... 2 1.3.1
Computer Architecture Background
CSE 5095 & ECE 4451 & ECE 5451 Spring 2017 Lecture 2b Computer Architecture Background Marten van Dijk Syed Kamran Haider, Chenglu Jin, Phuong Ha Nguyen Department of Electrical & Computer Engineering
A Hardware-Assisted Virtualization Based Approach on How to Protect the Kernel Space from Malicious Actions
A Hardware-Assisted Virtualization Based Approach on How to Protect the Kernel Space from Malicious Actions Eric Lacombe 1 Ph.D Supervisors: Yves Deswarte and Vincent Nicomette 1 eric.lacombe@security-labs.org
Virtualization. Virtualization
Virtualization Virtualization Memory virtualization Process feels like it has its own address space Created by MMU, configured by OS Storage virtualization Logical view of disks connected to a machine
Virtualization. Starting Point: A Physical Machine. What is a Virtual Machine? Virtualization Properties. Types of Virtualization
Starting Point: A Physical Machine Virtualization Based on materials from: Introduction to Virtual Machines by Carl Waldspurger Understanding Intel Virtualization Technology (VT) by N. B. Sahgal and D.
Virtualization. ! Physical Hardware Processors, memory, chipset, I/O devices, etc. Resources often grossly underutilized
Starting Point: A Physical Machine Virtualization Based on materials from: Introduction to Virtual Machines by Carl Waldspurger Understanding Intel Virtualization Technology (VT) by N. B. Sahgal and D.
Attacking and Defending the Platform
presented by Attacking and Defending the Platform Spring 2018 UEFI Seminar and Plugfest March 26-30, 2018 Presented by Erik Bjorge and Maggie Jauregui (Intel) Legal Notice No computer system can be absolutely
Security Issues Related to Pentium System Management Mode
Security Issues Related to Pentium System Management Mode Loïc Duflot Direction Centrale de la Sécurité des Systèmes d Information loic.duflot@sgdn.pm.gouv.fr SGDN/DCSSI 51 boulevard de la Tour Maubourg
Extended Page Tables (EPT) A VMM must protect host physical memory Multiple guest operating systems share the same host physical memory VMM typically implements protections through page-table shadowing
Programmed I/O accesses: a threat to Virtual Machine Monitors?
Programmed I/O accesses: a threat to Virtual Machine Monitors? Loïc Duflot & Laurent Absil Central Department for Information Systems Security SGDN/DCSSI 51 boulevard de la Tour Maubourg 75007 Paris Introduction
Intel Graphics Virtualization on KVM. Aug KVM Forum 2011 Rev. 3
Intel Graphics Virtualization on KVM Aug-16-2011 allen.m.kay@intel.com KVM Forum 2011 Rev. 3 Agenda Background on IO Virtualization Device Operation on Native Platform QEMU IO Virtualization Device Direct
Intel Virtualization Technology Roadmap and VT-d Support in Xen
Intel Virtualization Technology Roadmap and VT-d Support in Xen Jun Nakajima Intel Open Source Technology Center Legal Disclaimer INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS.
Virtual Machine Security
Virtual Machine Security CSE443 - Spring 2012 Introduction to Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ 1 Operating System Quandary Q: What is the primary goal
Virtualization with XEN. Trusted Computing CS599 Spring 2007 Arun Viswanathan University of Southern California
Virtualization with XEN Trusted Computing CS599 Spring 2007 Arun Viswanathan University of Southern California A g e n d a Introduction Virtualization approaches Basic XEN Architecture Setting up XEN Bootstrapping
To EL2, and Beyond! connect.linaro.org. Optimizing the Design and Implementation of KVM/ARM
To EL2, and Beyond! Optimizing the Design and Implementation of KVM/ARM LEADING COLLABORATION IN THE ARM ECOSYSTEM Christoffer Dall Shih-Wei Li connect.linaro.org
CSE 120 Principles of Operating Systems
CSE 120 Principles of Operating Systems Spring 2018 Lecture 16: Virtual Machine Monitors Geoffrey M. Voelker Virtual Machine Monitors 2 Virtual Machine Monitors Virtual Machine Monitors (VMMs) are a hot
Digging Into The Core of Boot
Digging Into The Core of Boot Yuriy Bulygin Oleksandr Bazhaniuk @c7zero @ABazhaniuk Agenda Intro Recap of MMIO BAR Issues in Coreboot & UEFI Coreboot ACPI GNVS Pointer Issue SMI Handler Issues in Coreboot
AMD Pacifica Virtualization Technology
AMD Pacifica Virtualization Technology AMD Unveils Virtualization Platform AMD Pacifica Tutorial 2 Virtual Machine Approaches Carve a Server into Many Virtual Machines Hosted Virtualization Hypervisor-based
Intel VMX technology
Intel VMX technology G. Lettieri 28 Oct. 2015 1 The Virtual Machine Monitor In the context of hardware-assisted virtualization, it is very common to introduce the concept of a Virtual Machine Monitor (VMM).
Hardware assisted Virtualization in Embedded
Hardware assisted Virtualization in Embedded Tanveer Alam Platform Architect Embedded Virtualization Sponsored by: & Agenda Embedded Virtualization What is embedded? Embedded specific requirements Key
HyperSentry: Enabling Stealthy In-context Measurement of Hypervisor Integrity
HyperSentry: Enabling Stealthy In-context Measurement of Hypervisor Integrity Ahmed M. Azab Peng Ning Zhi Wang Xuxian Jiang Department of Computer Science, North Carolina State University {amazab, pning,
Cloud Computing Virtualization
Cloud Computing Virtualization Anil Madhavapeddy anil@recoil.org Contents Virtualization. Layering and virtualization. Virtual machine monitor. Virtual machine. x86 support for virtualization. Full and
VIRTUALIZATION technologies have become the de facto
332 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING, VOL. 11, NO. 4, JULY/AUGUST 2014 HyperCheck: A Hardware-Assisted Integrity Monitor Fengwei Zhang, Jiang Wang, Kun Sun, and Angelos Stavrou Abstract
Hardware Involved Software Attacks
Hardware Involved Software Attacks Jeff Forristal CanSecWest 2012 Once you have root/admin, what s left to do? Question Rootkits VM escapes hacking/ priv escalation BIOS hacking Jail breaking Relevance
Secure In-VM Monitoring Using Hardware Virtualization
Secure In-VM Monitoring Using Hardware Virtualization Monirul Sharif Georgia Institute of Technology Atlanta, GA, USA msharif@cc.gatech.edu Wenke Lee Georgia Institute of Technology Atlanta, GA, USA wenke@cc.gatech.edu
4th Generation Intel Core vpro Processors with Intel VMCS Shadowing
white paper 4th Generation Intel Core vpro Processors with Intel VMCS Shadowing Enhancing the Performance of Citrix XenClient and McAfee Deep Defender* Contents Executive Summary... 1 Hardware-Assisted
CSC 5930/9010 Cloud S & P: Virtualization
CSC 5930/9010 Cloud S & P: Virtualization Professor Henry Carter Fall 2016 Recap Network traffic can be encrypted at different layers depending on application needs TLS: transport layer IPsec: network
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 1 Operating System Quandary Q: What is the primary goal of
Advanced Systems Security: Virtual Machine Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
The Challenges of X86 Hardware Virtualization. GCC- Virtualization: Rajeev Wankar 36
The Challenges of X86 Hardware Virtualization GCC- Virtualization: Rajeev Wankar 36 The Challenges of X86 Hardware Virtualization X86 operating systems are designed to run directly on the bare-metal hardware,
INF3510 Information Security Spring Lecture 4 Computer Security. University of Oslo Audun Jøsang
INF3510 Information Security Spring 2015 Lecture 4 Computer Security University of Oslo Audun Jøsang Lecture Overview Fundamental computer security concepts CPU and OS kernel security mechanisms Virtualization
Scotch: Combining Software Guard Extensions and System Management Mode to Monitor Cloud Resource Usage
Scotch: Combining Software Guard Extensions and System Management Mode to Monitor Cloud Resource Usage Kevin Leach 1, Fengwei Zhang 2, and Westley Weimer 3 1 University of Virginia, Charlottesville, VA
PROTECTING VM REGISTER STATE WITH AMD SEV-ES DAVID KAPLAN LSS 2017
PROTECTING VM REGISTER STATE WITH AMD SEV-ES DAVID KAPLAN LSS 2017 BACKGROUND-- HARDWARE MEMORY ENCRYPTION AMD Secure Memory Encryption (SME) / AMD Secure Encrypted Virtualization (SEV) Hardware AES engine
CprE Virtualization. Dr. Yong Guan. Department of Electrical and Computer Engineering & Information Assurance Center Iowa State University
Virtualization Dr. Yong Guan Department of Electrical and Computer Engineering & Information Assurance Center Iowa State University Outline for Today s Talk Introduction Virtualization Technology Applications
Virtualization and memory hierarchy
Virtualization and memory hierarchy Computer Architecture J. Daniel García Sánchez (coordinator) David Expósito Singh Francisco Javier García Blas ARCOS Group Computer Science and Engineering Department
CSE Computer Security
CSE 543 - Computer Security Lecture 25 - Virtual machine security December 6, 2007 URL: http://www.cse.psu.edu/~tjaeger/cse543-f07/ 1 Implementation and Results Experimental Platform Exact specification
INF3510 Information Security. Lecture 6: Computer Security. Universitetet i Oslo Audun Jøsang
INF3510 Information Security Lecture 6: Computer Security Universitetet i Oslo Audun Jøsang Lecture Overview Secure computer architectures Virtualisation architectures Trusted computing Security Evaluation
Pacifica Next Generation Architecture for Efficient Virtual Machines
Pacifica Next Generation Architecture for Efficient Virtual Machines Steve McDowell Division Marketing Manager Computation Products Group AMD steven.mcdowell@amd.com Geoffrey Strongin Platform Security
G Xen and Nooks. Robert Grimm New York University
G22.3250-001 Xen and Nooks Robert Grimm New York University Agenda! Altogether now: The three questions! The (gory) details of Xen! We already covered Disco, so let s focus on the details! Nooks! The grand
Fakultät Informatik Institut für Systemarchitektur, Betriebssysteme THE NOVA KERNEL API. Julian Stecklina
Fakultät Informatik Institut für Systemarchitektur, Betriebssysteme THE NOVA KERNEL API Julian Stecklina (jsteckli@os.inf.tu-dresden.de) Dresden, 5.2.2012 00 Disclaimer This is not about OpenStack Compute.
Intel s s Security Vision for Xen
Intel s s Security Vision for Xen Carlos Rozas Intel Corporation Xen Summit April 7-8, 7 2005 INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. EXCEPT AS PROVIDED IN INTEL'S TERMS
Spring 2017 :: CSE 506. Introduction to. Virtual Machines. Nima Honarmand
Introduction to Virtual Machines Nima Honarmand Virtual Machines & Hypervisors Virtual Machine: an abstraction of a complete compute environment through the combined virtualization of the processor, memory,
Module 1: Virtualization. Types of Interfaces
Module 1: Virtualization Virtualization: extend or replace an existing interface to mimic the behavior of another system. Introduced in 1970s: run legacy software on newer mainframe hardware Handle platform
SecVisor: A Tiny Hypervisor for Lifetime Kernel Code Integrity
SecVisor: A Tiny Hypervisor for Lifetime Kernel Code Integrity Arvind Seshadri, Mark Luk, Ning Qu, Adrian Perrig Carnegie Mellon University Kernel rootkits Motivation Malware inserted into OS kernels Anti
SoK: A Study of Using Hardwareassisted. Environments for Security. Fengwei Zhang and Hongwei Zhang. Wayne State University Detroit, Michigan, USA
SoK: A Study of Using Hardwareassisted Isolated Execu
references Virtualization services Topics Virtualization
references Virtualization services Virtual machines Intel Virtualization technology IEEE xplorer, May 2005 Comparison of software and hardware techniques for x86 virtualization ASPLOS 2006 Memory resource
Security for the Xen Hypervisor Status Quo & Perspective 2006
Security for the Xen Hypervisor Status Quo & Perspective 2006 Reiner Sailer Xen Summit 2006 IBM T J Watson Research Center 1/17/2006 1. Access Control Module 2. Virtual Trusted Platform Module 2 IBM T
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
Chap.6 Limited Direct Execution. Dongkun Shin, SKKU
Chap.6 Limited Direct Execution 1 Problems of Direct Execution The OS must virtualize the CPU in an efficient manner while retaining control over the system. Problems how can the OS make sure the program
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
W11 Hyper-V security. Jesper Krogh.
W11 Hyper-V security Jesper Krogh jesper_krogh@dell.com Jesper Krogh Speaker intro Senior Solution architect at Dell Responsible for Microsoft offerings and solutions within Denmark Specialities witin:
Introduction Construction State of the Art. Virtualization. Bernhard Kauer OS Group TU Dresden Dresden,
Virtualization Bernhard Kauer OS Group TU Dresden bk@vmmon.org Dresden, 2010-07-15 Motivation The vision: general-purpose OS secure trustworthy small fast fancy First problem: Legacy Application Supporting
Advanced Operating Systems (CS 202) Virtualization
Advanced Operating Systems (CS 202) Virtualization Virtualization One of the natural consequences of the extensibility research we discussed What is virtualization and what are the benefits? 2 Virtualization
COSC6376 Cloud Computing Lecture 14: CPU and I/O Virtualization
COSC6376 Cloud Computing Lecture 14: CPU and I/O Virtualization Instructor: Weidong Shi (Larry), PhD Computer Science Department University of Houston Outline CPU Virtualization I/O Virtualization Types
HYPERVISORS IN YOUR TOOLBOX SATOSHI TANDA & TIMO KREUZER,
HYPERVISORS IN YOUR TOOLBOX SATOSHI TANDA & TIMO KREUZER, SOFTWARE ENGINEERS, STRATEGIC RESEARCH INITIATIVES TAKEAWAYS Developing a simple hypervisor is easier than ever Even a simple hypervisor can open
O p t i m i z e d U E F I I m p l e m e n t a t i o n o n I n t e l X e o n B a s e d O C P P l a t f o r m
O p t i m i z e d U E F I I m p l e m e n t a t i o n o n I n t e l X e o n B a s e d O C P P l a t f o r m Sarathy Jayakumar, Principal Engineer, Intel Corp Mohan J. Kumar, Fellow, Intel Corp B a s e
Introduction to Qubes OS
Introduction to Qubes OS bhyvecon Tokyo 2014 @ntddk Self-introduction Yuma Kurogome(@ntddk) Takeda Lab @ KEIO Univ. Researching about security in low-layer Participant of Security Camp '11, '13 CTF player
I Don't Want to Sleep Tonight:
I Don't Want to Sleep Tonight: Subverting Intel TXT with S3 Sleep Seunghun Han, Jun-Hyeok Park (hanseunghun parkparkqw)@nsr.re.kr Wook Shin, Junghwan Kang, HyoungChun Kim (wshin ultract khche)@nsr.re.kr
Operating system hardening
Operating system Comp Sci 3600 Security Outline 1 2 3 4 5 6 What is OS? Hardening process that includes planning, ation, uration, update, and maintenance of the operating system and the key applications
CS 350 Winter 2011 Current Topics: Virtual Machines + Solid State Drives
CS 350 Winter 2011 Current Topics: Virtual Machines + Solid State Drives Virtual Machines Resource Virtualization Separating the abstract view of computing resources from the implementation of these resources
Chapter 5 C. Virtual machines
Chapter 5 C Virtual machines Virtual Machines Host computer emulates guest operating system and machine resources Improved isolation of multiple guests Avoids security and reliability problems Aids sharing
CS 550 Operating Systems Spring Introduction to Virtual Machines
CS 550 Operating Systems Spring 2018 Introduction to Virtual Machines 1 How to share a physical computer Operating systems allows multiple processes/applications to run simultaneously Via process/memory
General-purpose computing with VirtualBox on Genode/NOVA. Norman Feske
General-purpose computing with VirtualBox on Genode/NOVA Norman Feske Outline 1. VirtualBox 2. NOVA microhypervisor and Genode 3. Transplantation of VirtualBox to NOVA 4.
Runtime VM Protection By Intel Multi-Key Total Memory Encryption (MKTME)
Runtime VM Protection By Intel Multi-Key Total Memory Encryption (MKTME) Kai Huang @ Intel Corporation LINUXCON + CONTAINERCON + CLOUDOPEN Beijing, China, 2018 1 Legal Disclaimer No license (express or
Speculative Execution Side Channel Mitigations
Speculative Execution Side Channel Mitigations Revision 3.0 May 2018 Any future revisions to this content can be found at https://software.intel.com/security-software-guidance/ when new information is
Who Watches the Watcher? Detecting Hypervisor Introspection from Unprivileged Guests
Tomasz Tuzel Who Watches the Watcher? Detecting Hypervisor Introspection from Unprivileged Guests Overview The Cloud Numerous organizations are moving en masse to the cloud It s easier to manage It s easier
Nested Virtualization Update From Intel. Xiantao Zhang, Eddie Dong Intel Corporation
Nested Virtualization Update From Intel Xiantao Zhang, Eddie Dong Intel Corporation Legal Disclaimer INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE, EXPRESS OR IMPLIED,
INFLUENTIAL OPERATING SYSTEM RESEARCH: SECURITY MECHANISMS AND HOW TO USE THEM CARSTEN WEINHOLD
Faculty of Computer Science Institute of Systems Architecture, Operating Systems Group INFLUENTIAL OPERATING SYSTEM RESEARCH: SECURITY MECHANISMS AND HOW TO USE THEM CARSTEN WEINHOLD OVERVIEW Fundamental
[537] Virtual Machines. Tyler Harter
![[537] Virtual Machines. Tyler Harter](/thumbs/78/76966859.jpg "[537] Virtual Machines. Tyler Harter")
[537] Virtual Machines Tyler Harter Outline Machine Virtualization Overview CPU Virtualization (Trap-and-Emulate) CPU Virtualization (Modern x86) Memory Virtualization Performance Challenges Outline Machine
Transplantation of VirtualBox to the NOVA microhypervisor. Norman Feske
Transplantation of VirtualBox to the NOVA microhypervisor Norman Feske Outline 1. VirtualBox 2. NOVA microhypervisor and Genode 3. Steps 4. Demo + Outlook 5. War stories
Fourteenforty Research Institute, Inc.
A Hypervisor IPS based on Hardware Assisted Virtualization Technology Fourteenforty Research Institute, Inc. Fourteenforty Research Institute, Inc. http://www.fourteenforty.jp Senior Research Engineer
Virtual machine architecture and KVM analysis D 陳彥霖 B 郭宗倫
Virtual machine architecture and KVM analysis D97942011 陳彥霖 B96902030 郭宗倫 Virtual machine monitor serves as an interface between hardware and software; no matter what kind of hardware under, software can
1 Virtualization Recap
1 Virtualization Recap 2 Recap 1 What is the user part of an ISA? What is the system part of an ISA? What functionality do they provide? 3 Recap 2 Application Programs Libraries Operating System Arrows?
CSCE Introduction to Computer Systems Spring 2019
CSCE 313-200 Introduction to Computer Systems Spring 2019 Processes Dmitri Loguinov Texas A&M University January 24, 2019 1 Chapter 3: Roadmap 3.1 What is a process? 3.2 Process states 3.3 Process description
Lecture 7. Xen and the Art of Virtualization. Paul Braham, Boris Dragovic, Keir Fraser et al. 16 November, Advanced Operating Systems
Lecture 7 Xen and the Art of Virtualization Paul Braham, Boris Dragovic, Keir Fraser et al. Advanced Operating Systems 16 November, 2011 SOA/OS Lecture 7, Xen 1/38 Contents Virtualization Xen Memory CPU
Privacy Protection on Cloud Computing
Virginia Commonwealth University VCU Scholars Compass Theses and Dissertations Graduate School 2015 Privacy Protection on Cloud Computing Min Li Follow this and additional works at: https://scholarscompass.vcu.edu/etd
I/O virtualization. Jiang, Yunhong Yang, Xiaowei Software and Service Group 2009 虚拟化技术全国高校师资研讨班
I/O virtualization Jiang, Yunhong Yang, Xiaowei 1 Legal Disclaimer INFORMATION IN THIS DOCUMENT IS PROVIDED IN CONNECTION WITH INTEL PRODUCTS. NO LICENSE,
Advanced Systems Security: Virtual Machine Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
24-vm.txt Mon Nov 21 22:13: Notes on Virtual Machines , Fall 2011 Carnegie Mellon University Randal E. Bryant.
24-vm.txt Mon Nov 21 22:13:36 2011 1 Notes on Virtual Machines 15-440, Fall 2011 Carnegie Mellon University Randal E. Bryant References: Tannenbaum, 3.2 Barham, et al., "Xen and the art of virtualization,"
Tailoring TrustZone as SMM Equivalent
presented by Tailoring TrustZone as SMM Equivalent Tony C.S. Lo Senior Manager American Megatrends Inc. UEFI Plugfest March 2016 www.uefi.org 1 Agenda Introduction ARM TrustZone SMM-Like Services in TrustZone
Operating Systems 4/27/2015
Virtualization inside the OS Operating Systems 24. Virtualization Memory virtualization Process feels like it has its own address space Created by MMU, configured by OS Storage virtualization Logical view