Multi-Level Security Requirements for Hypervisors

Using hypervisors or virtual machine monitors for security has become very popular in recent years, and a number of proposals have been made for supporting multi-level security on secure hypervisors, including PR/SM, NetTop, sHype, and others. This paper looks at the requirements that users of MLS systems will have and discusses their implications on the design of multi-level secure hypervisors. It contrasts the new directions for secure hypervisors with the earlier efforts of KVM/370 and Digital’s A1-secure VMM kernel. 1 Purpose of this paper There have been a number of recent efforts to develop multi-level security (MLS) for hypervisors or virtual machine monitors (VMMs), such as NetTop [40], sHype [44], and a proposed combination of Xen [17] and sHype [33]. There has been a lot of confusion about what the requirements are to adequately support multi-level security (MLS) in a hypervisor. The hypervisor is being used to separate multiple instances of untrusted operating systems, ru...

• Type: Conference
• Year: 2005
• Where: ACSAC
• Authors: Paul A. Karger
• Keywords: ACSAC 2005, Multi-level Security, Secure Hypervisors, Security Privacy, Virtual Machine Monitors