Improving Xen Security through Disaggregation Derek Murray Grzegorz

Improving Xen Security through Disaggregation Derek Murray Grzegorz Milos Steven Hand

Outline • • • The myth of the secure hypervisor Trusted computing bases Disaggregating Xen Results Future work

Xen • Small hypervisor VM OS Xen Hardware – 100 k lines of code • Provides isolation between VMs • “Trusting the virtual machine monitor is akin to trusting a real processor”

Domain Zero Dom 0 VM Xen Hardware • Full Linux distribution • User-space tools for VM management • Privileged hypervisor interface – Map foreign memory – Set foreign VCPU • Therefore must be trusted

Threat Model • Malicious software running as Dom 0 root – Root exploit on Dom 0 – Untrusted administrator • Want to protect security of other VMs – Confidentiality – Integrity • Solution: disaggregation

Trusted Computing Base • “The set of components on which a subsystem depends” • “The totality of protection mechanisms. . . responsible for enforcing a computer security policy” • Anything that can directly invoke a privileged operation – And hence undermine security

Call Graph PD z PD y PD x

Current Xen Control Stack Build VM Dom 0 User Make hypercall Dom 0 Kernel Map memory Hypervisor Set VCPU

Minimise the TCB? Build VM Dom 0 User Make hypercall Dom 0 Kernel Map memory Hypervisor Set VCPU

Smaller is not always better Dom 0 User Build VM Make hypercall Dom. B Map memory Hypervisor Set VCPU

Implementation Xend … Dom 0 Dom. B Xen Dom. U

Results • Smaller, static TCB – No longer contains Dom 0 userspace – Now only VMM, Dom. B and Dom 0 kernel – With an I/O MMU, only VMM and Dom. B • Other VMs protected from Dom 0 root

Future Work • Virtual TPM support • Automated techniques for disaggregation • Metrics for trustworthiness

Conclusions • Virtualised TCB can be surprising • Smaller TCB is not always better • Choosing appropriate interfaces is crucial

Questions