Boxing clever with IOMMUs

ABSTRACT

Input/Output Memory Management Units (IOMMUs) have been touted as the solution to many problems in virtualisation security. Used naïvely, they can improve fault isolation and reduce the amount of trusted code. We contend that it is possible to do better.

In this paper, we introduce page boxing, a novel abstraction that allows untrusted virtual machines to manage data without having access to its contents. We illustrate how this can be used with an IOMMU to create a confidential end-to-end channel between disks and virtual machines. Unlike alternative approaches, we avoid the use of encryption, which gives the potential for high performance.

REFERENCES

• 1: Paul Barham , Boris Dragovic , Keir Fraser , Steven Hand , Tim Harris , Alex Ho , Rolf Neugebauer , Ian Pratt , Andrew Warfield, Xen and the art of virtualization, Proceedings of the nineteenth ACM symposium on Operating systems principles, October 19-22, 2003, Bolton Landing, NY, USA
• 2: M. Ben-Yehuda, J. Mason, O. Krieger, J. Xenidis, L. V. Doorn, A. Mallick, J. Nakajima, and E. Wahlig. Utilizing IOMMUs for Virtualization in Linux and Xen. In Proceedings of the 2006 Ottawa Linux Symposium, 2006.
• 3: Xiaoxin Chen , Tal Garfinkel , E. Christopher Lewis , Pratap Subrahmanyam , Carl A. Waldspurger , Dan Boneh , Jeffrey Dwoskin , Dan R.K. Ports, Overshadow: a virtualization-based approach to retrofitting protection in commodity operating systems, Proceedings of the 13th international conference on Architectural support for programming languages and operating systems, March 01-05, 2008, Seattle, WA, USA
• 4: K. Fraser, S. Hand, I. Pratt, A. Warfield, R. Neugebauer, and M. Williamson. Safe hardware access with the Xen virtual machine monitor. In OASIS'04: Proceedings of the 1st workshop on Operating System and Architectural Support for the on demand IT Infrastructure, 2004.
• 5: Hermann Härtig, Security architectures revisited, Proceedings of the 10th workshop on ACM SIGOPS European workshop, July 01-01, 2002, Saint-Emilion, France [doi>10.1145/1133373.1133376]
• 6: Derek Gordon Murray , Grzegorz Milos , Steven Hand, Improving Xen security through disaggregation, Proceedings of the fourth ACM SIGPLAN/SIGOPS international conference on Virtual execution environments, March 05-07, 2008, Seattle, WA, USA [doi>10.1145/1346256.1346278]
• 7: Timothy Roscoe , Kevin Elphinstone , Gernot Heiser, Hype and virtue, Proceedings of the 11th USENIX workshop on Hot topics in operating systems, p.1-6, May 07-09, 2007, San Diego, CA
• 8: (Unattributed). Preboot Execution Environment (PXE) Specification: Version 2.1, 9 1999. http://download.intel.com/design/archives/wfm/downloads/pxespec.pdf, accessed 9th June, 2008.
• 9: (Unattributed). Intel R Trusted Execution Technology Preliminary Architec ture Specification. Technical report, Intel Corporation, 2006. http://download.intel.com/technology/security/downloads/31516804.pdf, accessed 9th June, 2008.
• 10: (Unattributed). AMD64 Architecture Programmer's Manual Volume 2: System Programming. Technical report, Advanced Micro Devices, 2007. http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs%/24593.pdf, accessed9th June, 2008.
• 11: (Unattributed). Intel R Virtualization Technology for Directed I/O: Architecture Specification. Technical report, Intel Corporation, 9 2007. http://download.intel.com/technology/computing/vptech/Intel(r)_VT_for_Direct_IO.pdf, accessed 9th June, 2008.
• 12: (Unattributed). BitLocker Drive Encryption, 2008. http://technet.microsoft.com/en-us/windowsvista/aa905065.aspx, accessed 9th June, 2008.
• 13: (Unattributed). GNU GRUB -- GNU Project, 2008. http://www.gnu.org/software/grub/, accessed 9th June, 2008.
• 14: (Unattributed). Solaris ZFS, 2008. http://www.sun.com/software/solaris/zfs.jsp, accessed 9th June, 2008.
• 15: Carsten Weinhold , Hermann Härtig, VPFS: building a virtual private file system with a small trusted computing base, Proceedings of the 3rd ACM SIGOPS/EuroSys European Conference on Computer Systems 2008, April 01-04, 2008, Glasgow, Scotland UK
• 16: Emmett Witchel , Josh Cates , Krste Asanović, Mondrian memory protection, Proceedings of the 10th international conference on Architectural support for programming languages and operating systems, October 05-09, 2002, San Jose, California
• 17: Emmett Witchel , Junghwan Rhee , Krste Asanović, Mondrix: memory isolation for linux using mondriaan memory protection, Proceedings of the twentieth ACM symposium on Operating systems principles, October 23-26, 2005, Brighton, United Kingdom

INDEX TERMS

Primary Classification:
  B. Hardware
  B.4 INPUT/OUTPUT AND DATA COMMUNICATIONS
      B.4.2 Input/Output Devices

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.2 Storage Management
      D.4.6 Security and Protection

General Terms:
Design, Security

Keywords:
block device, iommu, virtualisation