TY - GEN
T1 - Bit visor
T2 - 2009 ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments, VEE'09
AU - Shinagawa, Takahiro
AU - Eiraku, Hideki
AU - Tanimoto, Kouichi
AU - Omote, Kazumasa
AU - Hasegawa, Shoichi
AU - Horie, Takashi
AU - Hirano, Manabu
AU - Kourai, Kenichi
AU - Oyama, Yoshihiro
AU - Kawai, Eiji
AU - Kono, Kenji
AU - Chiba, Shigeru
AU - Shinjo, Yasushi
AU - Kato, Kazuhiko
PY - 2009
Y1 - 2009
N2 - Virtual machine monitors (VMMs), including hypervisors, are a popular platform for implementing various security functionalities. However, traditional VMMs require numerous components for providing virtual hardware devices and for sharing and protecting system resources among virtual machines (VMs), enlarging the code size of and reducing the reliability of the VMMs. This paper introduces a hypervisor architecture, called parapassthrough, designed to minimize the code size of hypervisors by allowing most of the I/O access from the guest operating system (OS) to pass-through the hypervisor, while the minimum access necessary to implement security functionalities is completely mediated by the hypervisor. This architecture uses device drivers of the guest OS to handle devices, thereby reducing the size of components in the hypervisor to provide virtual devices. This architecture also allows to run only single VM on it, eliminating the components for sharing and protecting system resources among VMs. We implemented a hypervisor called BitVisor and a parapass-through driver for enforcing storage encryption of ATA devices based on the parapass-through architecture. The experimental result reveals that the hypervisor and ATA driver require approximately 20 kilo lines of code (KLOC) and 1.4 KLOC respectively.
AB - Virtual machine monitors (VMMs), including hypervisors, are a popular platform for implementing various security functionalities. However, traditional VMMs require numerous components for providing virtual hardware devices and for sharing and protecting system resources among virtual machines (VMs), enlarging the code size of and reducing the reliability of the VMMs. This paper introduces a hypervisor architecture, called parapassthrough, designed to minimize the code size of hypervisors by allowing most of the I/O access from the guest operating system (OS) to pass-through the hypervisor, while the minimum access necessary to implement security functionalities is completely mediated by the hypervisor. This architecture uses device drivers of the guest OS to handle devices, thereby reducing the size of components in the hypervisor to provide virtual devices. This architecture also allows to run only single VM on it, eliminating the components for sharing and protecting system resources among VMs. We implemented a hypervisor called BitVisor and a parapass-through driver for enforcing storage encryption of ATA devices based on the parapass-through architecture. The experimental result reveals that the hypervisor and ATA driver require approximately 20 kilo lines of code (KLOC) and 1.4 KLOC respectively.
KW - Hypervisors
KW - Parapass-through
KW - Shadow DMA descriptor
KW - Trusted computing base
KW - Virtual machine monitors
UR - http://www.scopus.com/inward/record.url?scp=67650079952&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=67650079952&partnerID=8YFLogxK
U2 - 10.1145/1508293.1508311
DO - 10.1145/1508293.1508311
M3 - Conference contribution
AN - SCOPUS:67650079952
SN - 9781605583754
T3 - Proceedings of the 2009 ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments, VEE'09
SP - 121
EP - 130
BT - Proceedings of the 2009 ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments, VEE'09
Y2 - 11 March 2009 through 13 March 2009
ER -