Bart Miller – October 22 nd, 2012

 TCB & Threat Model  Xen Platform  Xoar Architecture Overview  Xoar Components  Design Goals  Results  Security  Vulnerability Mitigation  Performance

 Trusted Computing Base is defined as “the totality of protection mechanisms within a computer system – including hardware, firmware, and software – the combination of which is responsible for enforcing a security policy.”  Xen, by virtue of privilege, is part of the TCB

 In Xen, all components operate under a monolithic trust domain  Compromise of any component yields two benefits:  Gain privilege level of component  Access its interfaces to other components

 Assumption #1: Administrators are not a concern  Business imperative  Assumption #2: Malicious guest VM  Violate data integrity or confidentiality  Exploiting code  Assumption #3: The control VM will contain bugs

 Device drivers  Virtualized, passed-through, or emulated  XenStore  Hierarchical key-value store  System-wide registry  Most critical component ▪ Vulnerable to DoS attacks ▪ Perform most administrative operations

 Toolstack  Administrative functions  Create, destroy, managing resources and privilege for guest VMs  System Boot  Starts DomO process, initialize hardware

 Reduce privilege  Each component should only have the privileges essential to its purpose  Each component should only expose interfaces when necessary

 Reduce sharing  Sharing components should be avoided wherever it is reasonable  Any sharing of components must be explicit  Allows for logging and auditing in the event of a compromise

 Reduce staleness  A component should only run for as long as it needs to perform its task.  It should be restored to a known, good state as frequently as practicable.

 Reduced TCB  Bootstrapper, PCIBack, and Builder are most privileged components  Bootstrapper and PCIBack destroyed once initialized  TCB reduced ▪ Linux: 7.6M LoC ▪ Builder: 13,5k LoC (Builder)

 Solved through isolation  Device Emulation  Virtualized Drivers  XenStore, re-written  Hypervisor vulnerabilities remain

 Test system  Ca server  Quad-core Xeon, 4Gb RAM  All virtualization features enabled  Memory overhead  512Mb – 896Mb in Xoar vs.  750Mb in XenServer

 Any questions?