Security Overview of the Integrity Virtual Machines Architecture

4
Virtual Ethernet Switches
Integrity VM virtualizes two major entities, computer systems (machines) and Ethernet network
switches. These “virtual switches” may be connected to virtual Network Interface Cards (NICs) on a
virtual machine and to logical network ports on the physical VM Host system.
VLANs allow a physical LAN to be segmented into multiple broadcast domains so that machines in
different VLANs may not communicate with each other. Integrity VM provides support for IEEE
802.1q VLAN functionality by enabling the configuration of ports on virtual switches to be isolated to
a given VLAN. The virtual switch tags all frames sent by virtual machine through that port.
Conversely, only those inbound frames tagged for that VLAN would be forwarded through that port to
the virtual machine, with the virtual switch removing the tags for those inbound frames.
Processor Virtualization
Virtual machines can have one or more virtual processors. These virtual processors are effectively
singe-core and single-threaded. Each virtual processor or virtual CPU (vCPU) is manifested as a single
thread executing on the VM Host system. Integrity VM forces these threads to execute on separate
physical processor cores while allowing them to begin execution at the same time. As a result, virtual
SMPs are protected from processing sluggishness caused by non-synchronous execution of their virtual
CPUs. At the same time, these virtual SMPs enjoy the benefits of the fair-share scheduling
functionality, precluding denial of service attacks.
Hyperthreading allows threads to share memory and state on a single processor and, as a result, may
provide opportunities for other software or virtual machines to monitor the execution and state of
another virtual machine. Integrity VM disables hyperthreading in the VM Host as well as inside the
virtual machines themselves, eliminating the potential for such security breaches.
Memory Virtualization
When a virtual machine is started, the virtual machine monitor allocates memory on the VM Host
system and presents that memory to the virtual machine as if it were private, physical memory. Each
virtual machine is provided with a virtualized physical address spaced called guest –physical
memory. The guest operating system manages this guest-physical memory in exactly the same way
the operating system manages physical memory on a physical computer system. The VMM manages
the mapping of guest-physical memory to real-physical memory on the VM Host system. Any
interaction of the guest operating system with its memory management entities such as page tables
and translation look-aside buffers are intercepted by the VMM, controlling access to physical memory
management structures.
If the guest operating system or its applications attempt to access memory other than what has been
allocated by the VMM, then Integrity VM delivers a fault to the guest operating system preventing
such behavior sometimes referred to as hyperspacing.
Integrity VM fills memory allocated initially to a virtual machine with zeros. Whenever a virtual
machine uses dynamic memory control to acquire guest-physical memory, that memory is also zero
filled before the VMM allows the virtual machine access. Hence, at any given point in time, a virtual
machine has exclusive access to memory and the contents of that memory cannot contain data from
any other virtual machine or process.