# HyperIO: A Hypervisor-Based Framework for Secure IO
## 5 Discussion
### Security  
To assess the security of HyperIO's design and the correctness of its implementation, we used several popular programs for screen capturing [34] and keylogging [35], see Table 2. With each program, we performed a short test, which included:  
1. entering the secure mode;2. typing a short message;
3. exiting the secure mode. In all cases, the keyloggers were unable to record the keystrokes. However, the screen-capturing programs continued to capture the operating system's video mode output.  
We measure the security of HyperIO and its competitors in terms of size (less SLOC is better). Table 3 presents the trusted code base of HyperIO and its competitors, while Fidelius, ProtectIon, Bumpy, and BitE have (almost) no software components, they require an external device to operate. Aurora and TrustLogin use the system management mode (SMM), which executes the firmware code. They have the smallest TCB among the systems that do not require external devices because all other systems must also trust the firmware code, which executes in the most privileged mode. The TCBs of T-PIM and Qubes OS include a full hypervisor. The size of a full hypervisor, such as Xen, is \(\approx\)600,000 SLOC. In Qubes OS, the sensitive information's safety also depends on the set of applications that share the same AppVM.  
Similarly to HyperIO, SGXIO is a thin hypervisor with a small TCB. However, SGXIO includes a full implementation of drivers for devices that act as sources or sinks of sensitive information. The drivers of display adapters are known for their large size. For example, the driver of a simple driver for the VMware SVGA II has \(\approx\)33,000 SLOC [36]. The code that handles the display adapter in HyperIO has \(\approx\)100 SLOC. HyperIO's hypervisor has \(\approx\)2000 SLOC, the cryptography library has \(\approx\)500 SLOC, and the editing code has \(\approx\)500 SLOC, summing up to \(\approx\)3000 SLOC. Furthermore, SGXIO requires SGX support. SGX is unavailable on AMD (SEV is the proposed alternative) and older CPUs (core i3/5/7 processors from 1 st to 5 th generations) by Intel. Furthermore SGX is now deprecated [37] and no longer available on newer Intel CPUs. (core i3/5/7 processors generations 11 th and above). SGX technology imposes many complications when delivering information into and out of a trusted enclave. The technology was not massively adopted by the industry and is no longer available in the three latest Intel CPU generations. SGX imposes many limitations on SGXIO requiring significant work on drivers not required in HyperIO and has a much larger footprint.  
\begin{table}
\begin{tabular}{l l l} \hline
**Solution** & **Trusted Code Base** & **External Device** \\ \hline SwitchMan & OS + FW & – \\ Fidelius/ProtectIon & – & V \\ Bumpy/BitE & – & V \\ Aurora & FW & – \\ TrustLogin & FW & – \\ T-PIM & FHV + FW & – \\ Qubes OS & FHV + FW & – \\ SGXIO & Drivers + THV + FW & – \\ HyperIO & THV + FW & – \\ \hline \end{tabular}
\end{table}
Table 1: Trusted code base (TCB) of related systems. The second column should be interpreted as follows: OS = operating system; FW = firmware; FHV = full hypervisor; and THV = thin hypervisor.  
\begin{table}
\begin{tabular}{l l} \hline
**Screen Capturing** & **Key Logging** \\ \hline OBS Studio & Spyrix Free Keylogger \\ FlashBack Express & Actual Keylogger \\ Debut Video Capture and & All In One Keylogger \\ ShareX & HomeGuard Activity Monitor \\ \hline \end{tabular}
\end{table}
Table 2: Screen-capturing and keylogging programs.