A VMM security kernel for the VAX architecture

Abstract

This paper describes the development of a virtual-machine monitor (VMM) security kernel for the VAX architecture. The paper particularly focuses on how the system's hardware, microcode, and software are aimed at meeting Aleffort has bccn primarily aimcd at identifying the differences and their cost in development effort and in kernel complexity.This paper dcscribes how the VAX security kcrncl meets its five InajOr goals:* Mcet all AI security rcquircments.levcl security requirements while maintaining the standard interfaces and applications of the VMS and ULTRIX-32 operating systems. The VAX security kcrncl supports multiple Run on commercial hardware without special modifications other than microcode changcs for virtualization.concurrent virtual machines on a single VAX system, providing isolation and controlled sharing of sensitive data. Rigorous engincering standards were applied during devclopmcnt to comply with the assurance requirements for verification and configuration management. The VAX security kcrncl has been dcveloped with a heavy emphasis on performance and on system managemcnt tools. The kcrnel pcrforms sufficicntly well that all of its development is now carricd out in virtual machines running on the kcrnel itself, rather than in a conventional time-sharing system.

Lessons from VAX/SVS for High Assurance VM Systems

“…Today, discussions of layered design tend to introduce additional complexity by allowing a richer tree of objects. SVS was an almost pure sequence of single layers (see Figure 1, from [1]). The absolute simplicity of the layering of the system is what gave the layered design some of its power as a structure for both call flow and overall system organization.…”

“…In May of 1990, "A VMM Security Kernel for the VAX Architecture" [1] was lead paper at the IEEE Symposium on Security and Privacy, and was awarded Best Paper. "The Auditing Facility for a VMM Security Kernel" [2] was also presented that year, and the year after, two papers on covert channels, "An Analysis of Covert Timing Channels" [3] and "Storage Channels in Disk Arm Optimization" [4] were presented.…”

“…More than 20 years later, we are taking this opportunity to highlight what we consider to be the most important results from [1], with an eye toward how they can inform how high assurance systems are considered and built today.…”

MYSEA: The Monterey Security Architecture

“…Various virtual machine monitor approaches have been suggested [14,42,7] for supporting COTS applications while reliably separating different domains of data. In general, for these approaches to be trustworthy requires both the use of strictly virtualizable hardware [29], and a trustworthy monitor mechanism for separating the activities of the virtual machines.…”

“…Creating a monitor sufficiently trusted to both separate different domains of activity, and allow read-down to less sensitive domains (as does MYSEA) is all the more difficult. While at least one was designed to provide high assurance read-down capabilities [42], it was never fielded. The VMM approach remains problematic for separation of different domains of data because of the difficulty of creating a trusted VMM.…”