A retrospective on the VAX VMM security kernel

Karger, Paul A.; Zurko, Mary Ellen; Bonin, D.W.; Mason, Alex; Kahn, C.

doi:10.1109/32.106971

Cited by 111 publications

(49 citation statements)

References 24 publications

(10 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Despite this level of accomplishment, VAX/SVS was cancelled because the business case for the system was not sufficient [15]. Even though a great deal of money had been spent bringing the system to the point where customers could use it, sales projections were not encouraging.…”

Section: Cancellationmentioning

confidence: 99%

Lessons from VAX/SVS for High Assurance VM Systems

Lipner

Jaeger

Zurko

2012

IEEE Secur. Privacy Mag.

View full text Add to dashboard Cite

VAX/SVS was a high assurance virtual machine monitor (VMM) project, documented in several published papers from the 1990's. We take a look back, extracting the most pertinent lessons from that work for today. These lessons cover reference monitor architectural principles, approaches to verifiable and tamperproof access control, the benefits of layering, the impacts of minimization and verification, and the business reasons behind its cancellation as a product.

show abstract

Section: Cancellationmentioning

confidence: 99%

Lessons from VAX/SVS for High Assurance VM Systems

Lipner

Jaeger

Zurko

2012

IEEE Secur. Privacy Mag.

View full text Add to dashboard Cite

show abstract

“…It differs from the VMM approach in that it exports hardware resources rather than emulates them. VMMs have served as the foundation of several "security kernels" [24,25,26,27]. Denali differs from these efforts in that it aims to provide scalability as well as isolation for untrusted code, but it does not provide any specialized for performance isolation.…”

Section: Related Workmentioning

confidence: 99%

Enforcing Performance Isolation Across Virtual Machines in Xen

Gupta

Cherkasova

Gardner

et al. 2006

Lecture Notes in Computer Science

177

167

View full text Add to dashboard Cite

Abstract. Virtual machines (VMs) have recently emerged as the basis for allocating resources in enterprise settings and hosting centers. One benefit of VMs in these environments is the ability to multiplex several operating systems on hardware based on dynamically changing system characteristics. However, such multiplexing must often be done while observing per-VM performance guarantees or service level agreements. Thus, one important requirement in this environment is effective performance isolation among VMs. In this paper, we address performance isolation across virtual machines in Xen [1]. For instance, while Xen can allocate fixed shares of CPU among competing VMs, it does not currently account for work done on behalf of individual VMs in device drivers. Thus, the behavior of one VM can negatively impact resources available to other VMs even if appropriate per-VM resource limits are in place.In this paper, we present the design and evaluation of a set of primitives implemented in Xen to address this issue. First, XenMon accurately measures per-VM resource consumption, including work done on behalf of a particular VM in Xen's driver domains. Next, our SEDF-DC scheduler accounts for aggregate VM resource consumption in allocating CPU. Finally, ShareGuard limits the total amount of resources consumed in privileged and driver domains based on administrator-specified limits. Our performance evaluation indicates that our mechanisms effectively enforce performance isolation for a variety of workloads and configurations.

show abstract

“…Furthermore, each layer can be tested in isolation from all higher layers, allowing debugging to proceed in an orderly fashion, rather than haphazardly throughout the system. -Paul A. Karger, et al [15] (p. 1154)…”

Section: Encompassing Codification For Evaluationmentioning

confidence: 99%

Using Proven Reference Monitor Patterns for Security Evaluation

Heckman

Schell²

2016

Information

View full text Add to dashboard Cite

Abstract:The most effective approach to evaluating the security of complex systems is to deliberately construct the systems using security patterns specifically designed to make them evaluable. Just such an integrated set of security patterns was created decades ago based on the Reference Monitor abstraction. An associated systematic security engineering and evaluation methodology was codified as an engineering standard in the Trusted Computer System Evaluation Criteria (TCSEC). This paper explains how the TCSEC and its Trusted Network Interpretation (TNI) constitute a set of security patterns for large, complex and distributed systems and how those patterns have been repeatedly and successfully used to create and evaluate some of the most secure government and commercial systems ever developed.

show abstract

A retrospective on the VAX VMM security kernel

Cited by 111 publications

References 24 publications

Lessons from VAX/SVS for High Assurance VM Systems

Lessons from VAX/SVS for High Assurance VM Systems

Enforcing Performance Isolation Across Virtual Machines in Xen

Using Proven Reference Monitor Patterns for Security Evaluation

Contact Info

Product

Resources

About