Proceedings of the 10th international conference on Architectural support for programming languages and operating systems
Xen and the art of virtualization
SOSP '03 Proceedings of the nineteenth ACM symposium on Operating systems principles
Mondrix: memory isolation for linux using mondriaan memory protection
Proceedings of the twentieth ACM symposium on Operating systems principles
Security architectures revisited
EW 10 Proceedings of the 10th workshop on ACM SIGOPS European workshop
Improving Xen security through disaggregation
Proceedings of the fourth ACM SIGPLAN/SIGOPS international conference on Virtual execution environments
Proceedings of the 13th international conference on Architectural support for programming languages and operating systems
VPFS: building a virtual private file system with a small trusted computing base
Proceedings of the 3rd ACM SIGOPS/EuroSys European Conference on Computer Systems 2008
HOTOS'07 Proceedings of the 11th USENIX workshop on Hot topics in operating systems
| Hi-index | 0.00 |
Input/Output Memory Management Units (IOMMUs) have been touted as the solution to many problems in virtualisation security. Used naïvely, they can improve fault isolation and reduce the amount of trusted code. We contend that it is possible to do better. In this paper, we introduce page boxing, a novel abstraction that allows untrusted virtual machines to manage data without having access to its contents. We illustrate how this can be used with an IOMMU to create a confidential end-to-end channel between disks and virtual machines. Unlike alternative approaches, we avoid the use of encryption, which gives the potential for high performance.