# Virtualization Airborne Trusted General Computing Technology
## 2 Architecture of the Virtualization Airborne Trusted General Computing Service Platform  
To meet the application requirements of new-generation civil aircraft, the airborne general computing service should fulfill the following major technical indicators:  
1. High-performance computing capability and mass storage capacity.
2. Provide an ARINC664P7 interface and gigabit Ethernet interface.
3. Provide a secure and trusted computing environment with network traffic access control, attack detection, and defense capabilities.
4. Support isolated resident operation environments for applications with different security levels.
5. Over a one-fold improvement in computing performance compared to existing devices with an identical weight and power consumption.  
Thus, clearly, the technical indicators of airborne general computing services, not only require an improvement in computing power, but should also meet isolation and security protection requirements. To this end, a high-performance multi-core processor is utilized to improve computing power, virtualization technology is employed to achieve isolation requirement, and trusted computing and virtualized security gateway technologies are adopted to meet security protection requirements, thereby designing a virtualization airborne trusted general computing service module (VATGCSM), as shown in Figure 1.  
The VATGCSM architecture mainly encompasses a hardware facility layer, virtualization management layer, and VM operation layer. The hardware facility layer consists of a high-performance processing hardware unit and a high-security hardware unit. The virtualization management layer comprises a microkernel VM management unit and a virtualization layer security middleware unit. The VM operation layer can execute multiple VMs, including the virtualized security gateway VM and application hosting VM, of which the latter consists of an application unit, a guest operating system kernel unit, and a VM security middleware unit.  
As the physical platform for the entire computing environment, the hardware facility layer offers the hardware resources necessary for operating the whole virtual environment, the hardware interfaces required by relevant businesses, as well as the functions of trusted computing modules. The virtualization management layer is the core scheduling layer in the virtualization mechanism, which provides the VM with functions such as hardware resource allocation, resource management, and communication security protection. The VM operation layer offers a resident environment for applications, which achieves separate residence for airborne application software with different security levels in the VMs.  
The hardware facility and virtualization management layers are connected through an internal logical interface. The high-performance processing hardware unit provides high-performance processing capability to the microkernel VM management unit, which also offers trusted computing services for the virtualization layer security middleware unit, by communicating with the high-security hardware unit.  
The virtualization management layer interacts with the VM operation layer through the system call interface. On the one hand, the virtualization management layer provides the VMs in the VM operation layer with allocation and management functions for virtualized hardware resources via the API interface, which is predefined by the microkernel VM management unit, and provides running environment support for the VM operation. On the other hand, it offers security protection for the communication among different VMs in the VM operation layer via the system call interface of the virtualization layer security middleware unit.