paper

Breaking Up is Hard to Do: Security and Functionality in a Commodity Hypervisor

  • Authors:
Read the paper

đź“ś Abstract

Virtualization platforms have grown with an increasing demand for new technologies, with the modern enterprise-ready virtualization platform being a complex, feature-rich piece of software. Despite the small size of hypervisors, the trusted computing base (TCB) of most enterprise platforms is larger than that of most monolithic commodity operating systems. Several key components of the Xen platform reside in a special, highly-privileged virtual machine or the “Control VM”. We present Xoar, a modified version of the Xen platform that retrofits the modularity and isolation principles championed by microkernels onto a mature virtualization platform. Xoar divides the large, shared control VM of Xen’s TCB into a set of independent, isolated, single purpose components called shards. Shards improve security in several ways: components are restricted to the least privilege necessary for functioning and any sharing between guest VMs is explicitly configurable and auditable in tune with the desired risk exposure policies. Microrebooting components at configurable frequencies reduces the temporal attack surface. Our approach does not require any existing functionality to be sacrificed and allows components to be reused rather than rewritten from scratch. The low performance overhead leads us to believe that Xoar is viable alternative for deployment in enterprise environments.

✨ Summary

  • The thesis presents Xoar, a modified Xen architecture that decomposes the monolithic control VM into isolated, single-purpose shards. The design applies microkernel principles—least privilege, reduced sharing, explicit auditing, and independently restartable components—while retaining compatibility with existing Xen functionality and guest VMs. (mihirnanavati.com)
  • The evaluation reports that Xoar reduced the trusted code associated with guest-memory access from the Linux control VM to a substantially smaller nanOS-based component, while maintaining near-baseline performance. The reported overhead for a Linux-kernel build was less than 1%, and network throughput decreased by approximately 1–2.5% in the tested configuration. (mihirnanavati.com)
  • The work was subsequently published in expanded form with Patrick Colp, Jun Zhu, William Aiello, George Coker, Tim Deegan, Peter Loscocco, and Andrew Warfield at the 23rd ACM Symposium on Operating Systems Principles in October 2011. (microsoft.com)
  • Subsequent research cited Xoar as an example of decomposing the management domain into service VMs. For example, the Self-Service Cloud model used a related privilege-separation approach to divide administrative responsibilities among system-wide, per-client, and service domains. Later work on secure VM management also identified Xoar as prior research on management-VM disaggregation. (pages.cs.wisc.edu)
  • The checked sources provide evidence of continuing research influence, but do not establish that Xoar itself became a broadly deployed commercial hypervisor product.