On achieving memory isolation among virtual machines through architectural support

Abstract

Virtualization technology evolved in attempts to achieve optimum utilisation of the expensive processing power of high-end computing machines. A virtual machine is an application of virtualization technology to run multiple operating systems on a single physical machine. A hypervisor is a software that creates virtual machines on a single physical machine by sharing the physical machine s resources in time and space division multiplexing. Sharing resources among virtual machines opens up venues for exploiting vulnerabilities in the sharing procedures, for attacks on the virtual machines. Literature survey on the security of virtual machines shows that there are vulnerabilities in the hypervisor software. Several of these vulnerabilities can be removed with hardware - assisted methods. Many hardware modifications have been proposed in literature for security enhancement, and some of them have been successfully incorporated in modern processors. Moreover, some hardware modifications are aimed at improving the performance of virtual machines. Review of literature on the security of virtual machines leads to the conclusion that complete virtual machine isolation is an essential requirement to be met by the hypervisor. Isolation at CPU, memory and network layers has to be ensured for the security of Virtual machines. Virtual machines should be as isolated functionally as are physical machines, and any communication between virtual machines should happen through network layer only. Existing literature reports several isolation issues in virtual machines. In this thesis, these issues are studied and categorized based on the hardware layer at which the issue originates. One of the primary sources of vulnerabilities, or deviations from a physical machine-like isolation, is the sharing of the common memory of the physical machine, by the different virtual machines. It is also one of the hardest to isolate as it is a single real infrastructure. Hence in this dissertation, the focus is on the memory layer.