SlideShare a Scribd company logo
1 of 21
Download to read offline
®




µ-Xen
Ian Pratt
SVP, Products
Bromium Inc.
                    1
Outline                                        ®




•   µ-Xen Goals
•   Architecture and implementation
•   Evolutionary path
•   Use case: Bromium end-point security


                                           2
The µ-Xen Client Hypervisor                              ®




• Derived from the Xen code base
• Designed to address client hypervisor deployment
  challenges
• Designed to achieve a high-degree of security
  assurance
• No requirement to support legacy s/w or h/w
• Optimized to support micro-virtualization
• Evolution to a new class of hypervisor
                                                     3
Evolution to a new class of hypervisor                  ®




• Start with a self-contained type-2
  – Host kernel module containing µ-Xen blob
  – Well-defined interface to/from the host
     • Memory allocation, Schedule VCPUs, Timers,
       Events
• Similar to hXen project
  – Windows, OS X; easily portable
  – µ-Xen drives VT hardware, leaves IO and other
    hardware to host OS                             4
µ-Xen streamlines Xen code base                        ®




• x64 only
• No support for systems that are not VTx/EPT or
  AMDV/NPT capable
• No support for PV MMU guests
• Significant code size reductions
• No compat code
• Separate build target
• Future: slim down instruction emulator
                                                   5
µ-Xen virtual IO                                                      ®




• µ-Xen demultiplexes IORecs and events to
  multiple host processes per VM
  – Able to have separate video, audio, disk, net etc processes
  – Helps scheduling latency, enables better exploitation
    mitigation lock-down
• Use just the relevant parts of QEMU
• User-space PV backend drivers
• Post-boot virtual IO device revocation

                                                                  6
Support for large numbers of similar VMs              ®




• Support for VM fork
  – Simple extension of Populate on Demand code
• Tree of templates/VMs supported
• PV driver support for re-sharing free pages
• IO tracking to re-share swapped and re-read
  pages

                                                  7
Evolution to a new class of hypervisor                        ®




• Goal: host is responsible for resource
  allocation, but can not interfere with the
  privacy or integrity of the hypervisor or other
  guests, e.g.:
  – Hypervisor asks host for memory, receives it, then
    removes host access to it
  – Host may perform IO on behalf of hypervisor and
    guests, but must be privacy and integrity protected
  – Host may deny service, crash; IO tamper detectable
                                                          8
De-privilege host into a VT container                                     ®




• Remove host access to hypervisor and guest memory in
  EPT tables
   – h/w devices passed through to host, VTd protected
• Device models can only access Granted memory
   – Require PV network and disk as no virtual DMA
   – Guest IO buffers encrypted/authenticated before grant copy/map
• Save/restore, dom builder must first have guest memory
  encrypted/authenticated by hypervisor
   – Hypervisor paging requires similar treatment

                                                                      9
Further Enhanced Security                                 ®




• Migrate certain host h/w devices to
  ownership by hypervisor or privileged
  guest(s), replace with virtual device
  – E.g. Keyboard controller to avoid key logging
  – Possibly WiFi/NIC too
• Measured launch of hypervisor
  – TXT/TPM to establish DRoT
  – Remote attestation of hypervisor configuration
                                                     10
Task-based Micro-virtualization
The Challenge
What Went Wrong?

 Poor Isolation leads to Vulnerability
   Multi-tenancy of code (& data) from a huge set of trust sources
   Code & Data are executed in the context of a few, weakly organized and
    poorly isolated “bins” representing levels of trust - e.g. UID, GID, PID
   Overloaded, complex specs & buggy implementations of porous
    interfaces
 Thus malware can:
   Access data and documents in the same “bin”
   Subvert other good code that is placed into the same “bin”
   Use another bug in an App or OS to elevate its privilege
Why Legacy Security Solutions Fail

Black-listing: Detection is not protection
   Doesn’t protect users from zero day attacks
   Unable to detect targeted & advanced malware

White-listing: Restriction is not protection
 Users want to be productive
 Attackers can compromise trusted applications and web sites
The Challenge




Bromium Confidential        15
Bromium Confidential
The Micro-Virtualization Approach


Next generation endpoint security
A   pragmatic approach to trusted computing

Based on hardware based isolation and not detection
 Contain risky activity from corporate data and network
 Block zero day and polymorphic threats


Provides isolation & trust through hardware virtualization
Lightweight, fast,
  Virtualizes vulnerable
                                        hidden, with an
   tasks within a single
                                        unchanged native UX
      Windows desktop

   Small code base for     Hypervisor   I/O Virtualization (VT-d)
    maximum security
                                        TXT & TPM based
                                        hardware root of
Hardware Virtualization                 trust
                 (VT-x)
The Microvisor isolates
                        vulnerable tasks from
                       Windows, each other &
                        key system resources
    Windows and IT
 Micro-VMs have
    provisioned apps
  “least privilege”
       are trusted
   access to files,                              Each vulnerable task
networks & devices,                               is instantly isolated
 and execute CoW                                     in a micro-VM,
                                                 invisible to the user
µ-Xen
Key Threat Vectors Are Isolated


Web Browsing                      E-mail Attachments
External Documents                USB files
Conclusions                                       ®




• µ-Xen is targeted at client systems
• Combines ease of deployment with useful
  security properties
• Enables task-based micro-virtualization,
  allowing mandatory access control to be
  retrofitted to commodity client OSes
• We’re hiring!   Please email ian@bromium.com
                                             21

More Related Content

What's hot

Dealing with Hardware Heterogeneity Using EmbeddedXEN, a Virtualization Frame...
Dealing with Hardware Heterogeneity Using EmbeddedXEN, a Virtualization Frame...Dealing with Hardware Heterogeneity Using EmbeddedXEN, a Virtualization Frame...
Dealing with Hardware Heterogeneity Using EmbeddedXEN, a Virtualization Frame...The Linux Foundation
 
XS Japan 2008 Project Status English
XS Japan 2008 Project Status EnglishXS Japan 2008 Project Status English
XS Japan 2008 Project Status EnglishThe Linux Foundation
 
Hypervisors and Virtualization - VMware, Hyper-V, XenServer, and KVM
Hypervisors and Virtualization - VMware, Hyper-V, XenServer, and KVMHypervisors and Virtualization - VMware, Hyper-V, XenServer, and KVM
Hypervisors and Virtualization - VMware, Hyper-V, XenServer, and KVMvwchu
 
Linux On V Mware ESXi
Linux On V Mware ESXiLinux On V Mware ESXi
Linux On V Mware ESXiMasafumi Ohta
 
Open source hypervisors in cloud
Open source hypervisors in cloudOpen source hypervisors in cloud
Open source hypervisors in cloudChetna Purohit
 
CSA Presentation 26th May Virtualization securityv2
CSA Presentation 26th May Virtualization securityv2CSA Presentation 26th May Virtualization securityv2
CSA Presentation 26th May Virtualization securityv2vivekbhat
 
cloud computing:Types of virtualization
cloud computing:Types of virtualizationcloud computing:Types of virtualization
cloud computing:Types of virtualizationDr.Neeraj Kumar Pandey
 
Hypervisor comparison 201212
Hypervisor comparison 201212Hypervisor comparison 201212
Hypervisor comparison 201212Chang kil Lee
 
Sierraware ARM hypervisor
Sierraware ARM hypervisor Sierraware ARM hypervisor
Sierraware ARM hypervisor Sierraware
 
5. IO virtualization
5. IO virtualization5. IO virtualization
5. IO virtualizationHwanju Kim
 
LCA13: Xen on ARM
LCA13: Xen on ARMLCA13: Xen on ARM
LCA13: Xen on ARMLinaro
 
VMware vSphere 5.1 Overview
VMware vSphere 5.1 OverviewVMware vSphere 5.1 Overview
VMware vSphere 5.1 OverviewESXLab
 
Building a Distributed Block Storage System on Xen
Building a Distributed Block Storage System on XenBuilding a Distributed Block Storage System on Xen
Building a Distributed Block Storage System on XenThe Linux Foundation
 
How to Optimize Microsoft Hyper-V Failover Cluster and Double Performance
How to Optimize Microsoft Hyper-V Failover Cluster and Double PerformanceHow to Optimize Microsoft Hyper-V Failover Cluster and Double Performance
How to Optimize Microsoft Hyper-V Failover Cluster and Double PerformanceStarWind Software
 

What's hot (20)

Dealing with Hardware Heterogeneity Using EmbeddedXEN, a Virtualization Frame...
Dealing with Hardware Heterogeneity Using EmbeddedXEN, a Virtualization Frame...Dealing with Hardware Heterogeneity Using EmbeddedXEN, a Virtualization Frame...
Dealing with Hardware Heterogeneity Using EmbeddedXEN, a Virtualization Frame...
 
XS Japan 2008 Project Status English
XS Japan 2008 Project Status EnglishXS Japan 2008 Project Status English
XS Japan 2008 Project Status English
 
Hypervisors and Virtualization - VMware, Hyper-V, XenServer, and KVM
Hypervisors and Virtualization - VMware, Hyper-V, XenServer, and KVMHypervisors and Virtualization - VMware, Hyper-V, XenServer, and KVM
Hypervisors and Virtualization - VMware, Hyper-V, XenServer, and KVM
 
Linux On V Mware ESXi
Linux On V Mware ESXiLinux On V Mware ESXi
Linux On V Mware ESXi
 
Open source hypervisors in cloud
Open source hypervisors in cloudOpen source hypervisors in cloud
Open source hypervisors in cloud
 
Ian Prattlinuxworld Xen Aug2008
Ian Prattlinuxworld Xen Aug2008Ian Prattlinuxworld Xen Aug2008
Ian Prattlinuxworld Xen Aug2008
 
CSA Presentation 26th May Virtualization securityv2
CSA Presentation 26th May Virtualization securityv2CSA Presentation 26th May Virtualization securityv2
CSA Presentation 26th May Virtualization securityv2
 
cloud computing:Types of virtualization
cloud computing:Types of virtualizationcloud computing:Types of virtualization
cloud computing:Types of virtualization
 
Hypervisors
HypervisorsHypervisors
Hypervisors
 
XS 2008 Boston VTPM
XS 2008 Boston VTPMXS 2008 Boston VTPM
XS 2008 Boston VTPM
 
Hypervisor comparison 201212
Hypervisor comparison 201212Hypervisor comparison 201212
Hypervisor comparison 201212
 
Cloud.pptm
Cloud.pptmCloud.pptm
Cloud.pptm
 
Sierraware ARM hypervisor
Sierraware ARM hypervisor Sierraware ARM hypervisor
Sierraware ARM hypervisor
 
5. IO virtualization
5. IO virtualization5. IO virtualization
5. IO virtualization
 
LCA13: Xen on ARM
LCA13: Xen on ARMLCA13: Xen on ARM
LCA13: Xen on ARM
 
VMware vSphere 5.1 Overview
VMware vSphere 5.1 OverviewVMware vSphere 5.1 Overview
VMware vSphere 5.1 Overview
 
Usenix Invited Talk
Usenix Invited TalkUsenix Invited Talk
Usenix Invited Talk
 
Building a Distributed Block Storage System on Xen
Building a Distributed Block Storage System on XenBuilding a Distributed Block Storage System on Xen
Building a Distributed Block Storage System on Xen
 
Virtual machine security
Virtual machine securityVirtual machine security
Virtual machine security
 
How to Optimize Microsoft Hyper-V Failover Cluster and Double Performance
How to Optimize Microsoft Hyper-V Failover Cluster and Double PerformanceHow to Optimize Microsoft Hyper-V Failover Cluster and Double Performance
How to Optimize Microsoft Hyper-V Failover Cluster and Double Performance
 

Viewers also liked

Asas nombor pecahan
Asas nombor pecahanAsas nombor pecahan
Asas nombor pecahanWirda Azyra
 
Business Idea Pitch Garage on Deman
Business Idea Pitch Garage on DemanBusiness Idea Pitch Garage on Deman
Business Idea Pitch Garage on DemanShesha R
 
Artikel P&B Magazine
Artikel P&B MagazineArtikel P&B Magazine
Artikel P&B Magazinewillemdemuynck
 
Scale11x : Virtualization with Xen and XCP
Scale11x : Virtualization with Xen and XCPScale11x : Virtualization with Xen and XCP
Scale11x : Virtualization with Xen and XCPLars Kurth
 
32 Ways a Digital Marketing Consultant Can Help Grow Your Business
32 Ways a Digital Marketing Consultant Can Help Grow Your Business32 Ways a Digital Marketing Consultant Can Help Grow Your Business
32 Ways a Digital Marketing Consultant Can Help Grow Your BusinessBarry Feldman
 

Viewers also liked (8)

Power 800 a[rev.0]
Power 800 a[rev.0]Power 800 a[rev.0]
Power 800 a[rev.0]
 
Asas nombor pecahan
Asas nombor pecahanAsas nombor pecahan
Asas nombor pecahan
 
MS Trust and Real MS
MS Trust and Real MSMS Trust and Real MS
MS Trust and Real MS
 
Business Idea Pitch Garage on Deman
Business Idea Pitch Garage on DemanBusiness Idea Pitch Garage on Deman
Business Idea Pitch Garage on Deman
 
Artikel P&B Magazine
Artikel P&B MagazineArtikel P&B Magazine
Artikel P&B Magazine
 
England Trip
England TripEngland Trip
England Trip
 
Scale11x : Virtualization with Xen and XCP
Scale11x : Virtualization with Xen and XCPScale11x : Virtualization with Xen and XCP
Scale11x : Virtualization with Xen and XCP
 
32 Ways a Digital Marketing Consultant Can Help Grow Your Business
32 Ways a Digital Marketing Consultant Can Help Grow Your Business32 Ways a Digital Marketing Consultant Can Help Grow Your Business
32 Ways a Digital Marketing Consultant Can Help Grow Your Business
 

Similar to µ-Xen

XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...
XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...
XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...The Linux Foundation
 
The VDI InfoSec Conundrum
The VDI InfoSec ConundrumThe VDI InfoSec Conundrum
The VDI InfoSec ConundrumVirtualTal
 
Securing your Cloud with Xen - SUSECon 2013
Securing your Cloud with Xen - SUSECon 2013Securing your Cloud with Xen - SUSECon 2013
Securing your Cloud with Xen - SUSECon 2013The Linux Foundation
 
virtualization(1).pptx
virtualization(1).pptxvirtualization(1).pptx
virtualization(1).pptxAkashRajBehera
 
Virtual Desktop Infrastructure Overview
Virtual Desktop Infrastructure OverviewVirtual Desktop Infrastructure Overview
Virtual Desktop Infrastructure Overviewkoesteruk22
 
Xen Project Update LinuxCon Brazil
Xen Project Update LinuxCon BrazilXen Project Update LinuxCon Brazil
Xen Project Update LinuxCon BrazilThe Linux Foundation
 
V mwarev sphere5.1notes-v2
V mwarev sphere5.1notes-v2V mwarev sphere5.1notes-v2
V mwarev sphere5.1notes-v2karanamsaibabu
 
ProtectV - Data Security for the Cloud
ProtectV - Data Security for the CloudProtectV - Data Security for the Cloud
ProtectV - Data Security for the CloudSafeNet
 
Zero footprint guest memory introspection from xen
Zero footprint guest memory introspection from xenZero footprint guest memory introspection from xen
Zero footprint guest memory introspection from xenBitdefender Enterprise
 
Virtualization securityv2
Virtualization securityv2Virtualization securityv2
Virtualization securityv2vivekbhat
 
Mitigating Risk for the Mobile Worker: Novell ZENworks Endpoint Security Mana...
Mitigating Risk for the Mobile Worker: Novell ZENworks Endpoint Security Mana...Mitigating Risk for the Mobile Worker: Novell ZENworks Endpoint Security Mana...
Mitigating Risk for the Mobile Worker: Novell ZENworks Endpoint Security Mana...Novell
 
LFNW2014 Advanced Security Features of Xen Project Hypervisor
LFNW2014 Advanced Security Features of Xen Project HypervisorLFNW2014 Advanced Security Features of Xen Project Hypervisor
LFNW2014 Advanced Security Features of Xen Project HypervisorThe Linux Foundation
 

Similar to µ-Xen (20)

Xen revisited
Xen revisitedXen revisited
Xen revisited
 
Xen Community Update 2011
Xen Community Update 2011Xen Community Update 2011
Xen Community Update 2011
 
XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...
XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...
XPDS14 - Zero-Footprint Guest Memory Introspection from Xen - Mihai Dontu, Bi...
 
The VDI InfoSec Conundrum
The VDI InfoSec ConundrumThe VDI InfoSec Conundrum
The VDI InfoSec Conundrum
 
Ina Pratt Fosdem Feb2008
Ina Pratt Fosdem Feb2008Ina Pratt Fosdem Feb2008
Ina Pratt Fosdem Feb2008
 
Securing your Cloud with Xen - SUSECon 2013
Securing your Cloud with Xen - SUSECon 2013Securing your Cloud with Xen - SUSECon 2013
Securing your Cloud with Xen - SUSECon 2013
 
Virtualization
VirtualizationVirtualization
Virtualization
 
virtualization(1).pptx
virtualization(1).pptxvirtualization(1).pptx
virtualization(1).pptx
 
virtualization.pptx
virtualization.pptxvirtualization.pptx
virtualization.pptx
 
Virtual Desktop Infrastructure Overview
Virtual Desktop Infrastructure OverviewVirtual Desktop Infrastructure Overview
Virtual Desktop Infrastructure Overview
 
Xen Project Update LinuxCon Brazil
Xen Project Update LinuxCon BrazilXen Project Update LinuxCon Brazil
Xen Project Update LinuxCon Brazil
 
V mwarev sphere5.1notes-v2
V mwarev sphere5.1notes-v2V mwarev sphere5.1notes-v2
V mwarev sphere5.1notes-v2
 
Virtualization
VirtualizationVirtualization
Virtualization
 
unit-2.pptx
unit-2.pptxunit-2.pptx
unit-2.pptx
 
ProtectV - Data Security for the Cloud
ProtectV - Data Security for the CloudProtectV - Data Security for the Cloud
ProtectV - Data Security for the Cloud
 
Zero footprint guest memory introspection from xen
Zero footprint guest memory introspection from xenZero footprint guest memory introspection from xen
Zero footprint guest memory introspection from xen
 
Virtualization securityv2
Virtualization securityv2Virtualization securityv2
Virtualization securityv2
 
Virtualization
VirtualizationVirtualization
Virtualization
 
Mitigating Risk for the Mobile Worker: Novell ZENworks Endpoint Security Mana...
Mitigating Risk for the Mobile Worker: Novell ZENworks Endpoint Security Mana...Mitigating Risk for the Mobile Worker: Novell ZENworks Endpoint Security Mana...
Mitigating Risk for the Mobile Worker: Novell ZENworks Endpoint Security Mana...
 
LFNW2014 Advanced Security Features of Xen Project Hypervisor
LFNW2014 Advanced Security Features of Xen Project HypervisorLFNW2014 Advanced Security Features of Xen Project Hypervisor
LFNW2014 Advanced Security Features of Xen Project Hypervisor
 

Recently uploaded

UiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation DevelopersUiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation DevelopersUiPathCommunity
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopBachir Benyammi
 
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCostKubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCostMatt Ray
 
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Will Schroeder
 
VoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXVoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXTarek Kalaji
 
UiPath Studio Web workshop series - Day 7
UiPath Studio Web workshop series - Day 7UiPath Studio Web workshop series - Day 7
UiPath Studio Web workshop series - Day 7DianaGray10
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureEric D. Schabell
 
Machine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfMachine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfAijun Zhang
 
Comparing Sidecar-less Service Mesh from Cilium and Istio
Comparing Sidecar-less Service Mesh from Cilium and IstioComparing Sidecar-less Service Mesh from Cilium and Istio
Comparing Sidecar-less Service Mesh from Cilium and IstioChristian Posta
 
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDEADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDELiveplex
 
9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding TeamAdam Moalla
 
Linked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond OntologiesLinked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond OntologiesDavid Newbury
 
Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024D Cloud Solutions
 
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UbiTrack UK
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IES VE
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...Aggregage
 
20230202 - Introduction to tis-py
20230202 - Introduction to tis-py20230202 - Introduction to tis-py
20230202 - Introduction to tis-pyJamie (Taka) Wang
 
AI Fame Rush Review – Virtual Influencer Creation In Just Minutes
AI Fame Rush Review – Virtual Influencer Creation In Just MinutesAI Fame Rush Review – Virtual Influencer Creation In Just Minutes
AI Fame Rush Review – Virtual Influencer Creation In Just MinutesMd Hossain Ali
 

Recently uploaded (20)

UiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation DevelopersUiPath Community: AI for UiPath Automation Developers
UiPath Community: AI for UiPath Automation Developers
 
NIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 WorkshopNIST Cybersecurity Framework (CSF) 2.0 Workshop
NIST Cybersecurity Framework (CSF) 2.0 Workshop
 
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCostKubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
KubeConEU24-Monitoring Kubernetes and Cloud Spend with OpenCost
 
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
Apres-Cyber - The Data Dilemma: Bridging Offensive Operations and Machine Lea...
 
VoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBXVoIP Service and Marketing using Odoo and Asterisk PBX
VoIP Service and Marketing using Odoo and Asterisk PBX
 
UiPath Studio Web workshop series - Day 7
UiPath Studio Web workshop series - Day 7UiPath Studio Web workshop series - Day 7
UiPath Studio Web workshop series - Day 7
 
OpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability AdventureOpenShift Commons Paris - Choose Your Own Observability Adventure
OpenShift Commons Paris - Choose Your Own Observability Adventure
 
Machine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdfMachine Learning Model Validation (Aijun Zhang 2024).pdf
Machine Learning Model Validation (Aijun Zhang 2024).pdf
 
Comparing Sidecar-less Service Mesh from Cilium and Istio
Comparing Sidecar-less Service Mesh from Cilium and IstioComparing Sidecar-less Service Mesh from Cilium and Istio
Comparing Sidecar-less Service Mesh from Cilium and Istio
 
20150722 - AGV
20150722 - AGV20150722 - AGV
20150722 - AGV
 
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDEADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
ADOPTING WEB 3 FOR YOUR BUSINESS: A STEP-BY-STEP GUIDE
 
9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team9 Steps For Building Winning Founding Team
9 Steps For Building Winning Founding Team
 
Linked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond OntologiesLinked Data in Production: Moving Beyond Ontologies
Linked Data in Production: Moving Beyond Ontologies
 
Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024Artificial Intelligence & SEO Trends for 2024
Artificial Intelligence & SEO Trends for 2024
 
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
UWB Technology for Enhanced Indoor and Outdoor Positioning in Physiological M...
 
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
IESVE Software for Florida Code Compliance Using ASHRAE 90.1-2019
 
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
The Data Metaverse: Unpacking the Roles, Use Cases, and Tech Trends in Data a...
 
20230202 - Introduction to tis-py
20230202 - Introduction to tis-py20230202 - Introduction to tis-py
20230202 - Introduction to tis-py
 
20230104 - machine vision
20230104 - machine vision20230104 - machine vision
20230104 - machine vision
 
AI Fame Rush Review – Virtual Influencer Creation In Just Minutes
AI Fame Rush Review – Virtual Influencer Creation In Just MinutesAI Fame Rush Review – Virtual Influencer Creation In Just Minutes
AI Fame Rush Review – Virtual Influencer Creation In Just Minutes
 

µ-Xen

  • 2. Outline ® • µ-Xen Goals • Architecture and implementation • Evolutionary path • Use case: Bromium end-point security 2
  • 3. The µ-Xen Client Hypervisor ® • Derived from the Xen code base • Designed to address client hypervisor deployment challenges • Designed to achieve a high-degree of security assurance • No requirement to support legacy s/w or h/w • Optimized to support micro-virtualization • Evolution to a new class of hypervisor 3
  • 4. Evolution to a new class of hypervisor ® • Start with a self-contained type-2 – Host kernel module containing µ-Xen blob – Well-defined interface to/from the host • Memory allocation, Schedule VCPUs, Timers, Events • Similar to hXen project – Windows, OS X; easily portable – µ-Xen drives VT hardware, leaves IO and other hardware to host OS 4
  • 5. µ-Xen streamlines Xen code base ® • x64 only • No support for systems that are not VTx/EPT or AMDV/NPT capable • No support for PV MMU guests • Significant code size reductions • No compat code • Separate build target • Future: slim down instruction emulator 5
  • 6. µ-Xen virtual IO ® • µ-Xen demultiplexes IORecs and events to multiple host processes per VM – Able to have separate video, audio, disk, net etc processes – Helps scheduling latency, enables better exploitation mitigation lock-down • Use just the relevant parts of QEMU • User-space PV backend drivers • Post-boot virtual IO device revocation 6
  • 7. Support for large numbers of similar VMs ® • Support for VM fork – Simple extension of Populate on Demand code • Tree of templates/VMs supported • PV driver support for re-sharing free pages • IO tracking to re-share swapped and re-read pages 7
  • 8. Evolution to a new class of hypervisor ® • Goal: host is responsible for resource allocation, but can not interfere with the privacy or integrity of the hypervisor or other guests, e.g.: – Hypervisor asks host for memory, receives it, then removes host access to it – Host may perform IO on behalf of hypervisor and guests, but must be privacy and integrity protected – Host may deny service, crash; IO tamper detectable 8
  • 9. De-privilege host into a VT container ® • Remove host access to hypervisor and guest memory in EPT tables – h/w devices passed through to host, VTd protected • Device models can only access Granted memory – Require PV network and disk as no virtual DMA – Guest IO buffers encrypted/authenticated before grant copy/map • Save/restore, dom builder must first have guest memory encrypted/authenticated by hypervisor – Hypervisor paging requires similar treatment 9
  • 10. Further Enhanced Security ® • Migrate certain host h/w devices to ownership by hypervisor or privileged guest(s), replace with virtual device – E.g. Keyboard controller to avoid key logging – Possibly WiFi/NIC too • Measured launch of hypervisor – TXT/TPM to establish DRoT – Remote attestation of hypervisor configuration 10
  • 13. What Went Wrong?  Poor Isolation leads to Vulnerability  Multi-tenancy of code (& data) from a huge set of trust sources  Code & Data are executed in the context of a few, weakly organized and poorly isolated “bins” representing levels of trust - e.g. UID, GID, PID  Overloaded, complex specs & buggy implementations of porous interfaces  Thus malware can:  Access data and documents in the same “bin”  Subvert other good code that is placed into the same “bin”  Use another bug in an App or OS to elevate its privilege
  • 14. Why Legacy Security Solutions Fail Black-listing: Detection is not protection  Doesn’t protect users from zero day attacks  Unable to detect targeted & advanced malware White-listing: Restriction is not protection  Users want to be productive  Attackers can compromise trusted applications and web sites
  • 15. The Challenge Bromium Confidential 15 Bromium Confidential
  • 16. The Micro-Virtualization Approach Next generation endpoint security A pragmatic approach to trusted computing Based on hardware based isolation and not detection  Contain risky activity from corporate data and network  Block zero day and polymorphic threats Provides isolation & trust through hardware virtualization
  • 17. Lightweight, fast, Virtualizes vulnerable hidden, with an tasks within a single unchanged native UX Windows desktop Small code base for Hypervisor I/O Virtualization (VT-d) maximum security TXT & TPM based hardware root of Hardware Virtualization trust (VT-x)
  • 18. The Microvisor isolates vulnerable tasks from Windows, each other & key system resources Windows and IT Micro-VMs have provisioned apps “least privilege” are trusted access to files, Each vulnerable task networks & devices, is instantly isolated and execute CoW in a micro-VM, invisible to the user
  • 20. Key Threat Vectors Are Isolated Web Browsing E-mail Attachments External Documents USB files
  • 21. Conclusions ® • µ-Xen is targeted at client systems • Combines ease of deployment with useful security properties • Enables task-based micro-virtualization, allowing mandatory access control to be retrofitted to commodity client OSes • We’re hiring! Please email ian@bromium.com 21

Editor's Notes

  1. dynamic content cannot be blacklistedmalicious content can compromise whitelisted apps