# HyperIO: A Hypervisor-Based Framework for Secure IO
## 3 System Design
### System Architecture  
Figure 1 depicts the architecture of HyperIO. HyperIO is a thin hypervisor embedded in an EFI application [15]. The EFI firmware loads the application, initializes the hypervisor, and then boots the operating system's bootloader, which executes inside the single virtual machine created by the hypervisor. Before initializing the hypervisor, the EFI application requests the EFI firmware to allocate a memory region for the hypervisor's code and data. This memory region is marked as reserved, and a benign operating system will not attempt to access it. However, to guarantee its security, the hypervisor uses the secondary-level address translation mechanism to make this memory region inaccessible to the VM. In addition, the hypervisor configures the IOMMU to ensure that this memory region is inaccessible from the peripheral devices. During the initialization, the hypervisor communicates with the TPM, retrieves the private key, and stores it in the secure memory region. HyperIO is able to acquire partial control over the screen and the keyboard. This control is sufficient for the HyperIO's operation on the one hand, and does not require HyperIO to include full drivers for these devices, thus keeping the code base at the required minimum.  
HyperIO has two modes of operation: regular and secure, while in secure mode, HyperIO protects the keyboard's input and the screen's output. The keyboard's scroll lock LED acts as a security indicator; it is on if, and only if, the secure mode is active. HyperIO prevents all the operating system's attempts to modify the scroll lock LED state regardless of the operation mode. When HyperIO switches to the secure mode, the system behaviour changes as follows:  
* HyperIO intercepts all the keystrokes and records them in a secure memory region;
* HyperIO switches the display adapter to the text mode; and
* HyperIO intercepts all attempts to change the video mode or access the display adapter's text mode buffer.  
The main functionality provided by HyperIO is the secure input and output of sensitive information in response to a request performed by an external entity, which we call the \"requester\". The requester is identified by a certificate. The requester encrypts the output that it intends to display using HyperIO's public-key. HyperIO encrypts the user's input using the requester's public-key.  
HyperIO exports its functionality via its two hypercalls: HcDisplay and HcAcquire. The HcDisplay hypercall receives two parameters: (a) an encrypted message to be displayed, (b) a certificate that identifies the requester. HyperIO reacts to this hypercall by switching to the secure mode and displaying the decrypted message and certificate. The hypercall returns immediately, thus allowing the operating system to handle interrupts and other events. HyperIO, however, remains in the secure mode until the user presses the \"scroll lock\" key. Until then, HyperIO replaces the intercepted keyboard strokes with an asterisk. An optional argument can be used to set another scancode for the replacement. The original keystrokes are translated to characters and recorded in a protected memory region, while the secure mode is active, HyperIO provides the users with a simple text editor, allowing them to scroll, navigate and edit the existing text.  
The HcAcquire hypercall returns the recorded characters encrypted using the requester's public key. This hypercall receives a single parameter: a pointer to a buffer that will receive the encrypted data.  
In the following sections, we describe the cryptographic infrastructure of HyperIO, the mode switching mechanism, and HyperIO's operation in each mode.