Survey of Security in Type 1 Hypervisors Brennon

With distributed systems becoming more prevalent in modern computing their security needs begin to scale exponentially with their use and integration. This paper intends to provide a brief survey of those security practices and methodologies put in place by major Type 1 Hypervisors currently in use. All data was collected through the software documentation provided by the corresponding manufacturer and thus take everything stated as ground truth as this survey does not cover penetration testing. This study focuses its efforts on Xen, VMware ESX(i), and Hyper-V distributions. Introduction Hypervisors, also known as Virtual Machine Monitors (VMMs), are applications which allow for the ability to run multiple operating systems on one or more machines. Just as an operating system’s job is to manage the local resources for a given machine so is the job for the hypervisor, but with a key difference in that the latter works on a set of machines rather than a single unit. Typically these hypervisors will sit on top of a bare metal computing cluster and provide a layer of transparency to each operating system it is hosting. This grants each operating system supported a given subset of the total physical resources available to the hypervisor. This type of hypervisor that sits directly about the bare metal components is referred to as a Type 1 Hypervisor. Type 2 Hypervisors are different in that they sit above an operating system which sits on top of the physical nodes, effectively one level higher than that of Type 1. This survey does not cover Type 2 Hypervisors as their security models and specifications are vastly different from their Type 1 counterparts because of the additional level of abstraction. It primarily focuses on the three most commonly used Type 1 Hypervisor distributions currently running in academic and enterprise environments; those being Xen, VMware ESX, and Hyper-V. Tanenbaum states in [1] that “VMMs will become increasingly important in the context of reliability and security for (distributed) systems. As they allow for the isolation of a complete application and its environment, a failure caused by an error or security attack need no longer affect a complete machine. ” While this statement holds true in most cases, it does not accurately portray the need for security pertaining to the VMM as a whole. These hypervisors are essentially the ‘command and control’ centers for each individual operating system hosted. This implies that if there is a breach in security at a VMM level, then there is a possibility that the attacker could gain access or information about every operating system running on the given VMM. These attacks could come from the operating system being supported if there are vulnerabilities lying dormant on the hypervisor. This attack vector effectively mitigates Tanenbaum’s statement as his security model only encompasses attacks enclosed within a given supported operating system. It is this minimized view of security that provides the inspiration for the work presented. Xen Hypervisor Xen began as an open source project that originated from the University of Cambridge Computer Laboratory in 2003 and, as of 2010, is now maintained by a community of members. The primary features of the Xen Hypervisor are its wide operational architecture range and ability to emulate nearly all operating systems. Currently the Xen system can run on IA-32, x86-64, Itanium, and ARM architectures. It can support all forms of Unix-based operating systems and, if utilizing the correct hardware, can also support versions of Microsoft Windows [5]. The special hardware needed pertains to specific virtualization capabilities available in the Intel VT-x [6] and AMD-V [7] processors. The Xen Hypervisor begins by launching a privileged node on startup, denoted as domain 0 or dom0, that controls the operations of each guest OS that launches subsequently, referred to as domain U, or domU. A key aspect of the Xen distribution is that, because of its wide architecture range, it is beginning to be ported to mobile and personal computers (e.g. cell