Improving virtualization security by splitting hypervisor into smaller components

  • Authors:

  • Wuqiong Pan;Yulong Zhang;Meng Yu;Jiwu Jing

  • Affiliations:

  • State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China, Department of Computer Science, Virginia Commonwealth University, R ...;Department of Computer Science, Virginia Commonwealth University, Richmond, VA;Department of Computer Science, Virginia Commonwealth University, Richmond, VA;State Key Laboratory of Information Security, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China

  • Venue:
  • DBSec'12 Proceedings of the 26th Annual IFIP WG 11.3 conference on Data and Applications Security and Privacy
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

In cloud computing, the security of infrastructure is determined by hypervisor (or Virtual Machine Monitor, VMM) designs. Unfortunately, in recent years, many attacks have been developed to compromise the hypervisor, taking over all virtual machines running above the hypervisor. Due to the functions a hypervisor provides, it is very hard to reduce its size. Including a big hypervisor in the Trusted Computing Base (TCB) is not acceptable for a secure system design. Several secure, small, and innovative hypervisor designs, e.g., TrustVisor, CloudVisor, etc., have been proposed to solve the problem. However, these designs either have reduced functionalities or pose strong restrictions to the virtual machines. In this paper, we propose an innovative hypervisor design that splits hypervisor's functions into a small enough component in the TCB, and other components to provide full functionalities. Our design can significantly reduce the TCB size without sacrificing functionalities. Our experiments also show acceptable costs of our design.