TWC: TTP Option: Small: A Linux ARM Hypervisor for System Security

TWC：TTP 选项：小型：用于系统安全的 Linux ARM 虚拟机管理程序

• 批准号: 1422909
• 负责人: Jason Nieh
• 金额: $ 63.51万
• 依托单位: Columbia University
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2014
• 资助国家: 美国
• 起止时间: 2014-10-01 至 2018-09-30
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1422909&HistoricalAwards=false
• 关键词: TWC; TTP; Option; Small; Linux

Mobile devices and embedded systems have become ubiquitous in our society. Such systems use ARM processors, which differ greatly from the traditional x86 processors found in larger computing devices. As devices become smaller, there is a growing demand for virtualization, which provides benefits such as energy efficiency and the ability to use the device in multiple operational modes. Virtualization is especially important in the context of system security as many security mechanisms leverage virtualization as a core technology for fault containment and isolation, intrusion detection, malware analysis, and the detection, diagnosis, and remediation of software vulnerabilities. To address the challenges of ARM virtualization, this project designs, implements, and deploys KVM/ARM, an open-source ARM hypervisor in the Linux operating system. Since the traditional x86 architecture is vastly different from ARM, past work on x86 hardware support for virtualization cannot be carried over to ARM. In addition, ARM processors vary greatly since each licensee of the ARM technology adapts and changes the systems software to meet their needs. Successfully creating an ARM hypervisor that is adaptable across a range of ARM implementations offers rich opportunities for incorporating security into the hardware itself. Adopting this research into mainline Linux code ensures that capability is broadly available on a supported foundation for system security research.

移动的设备和嵌入式系统在我们的社会中已经变得无处不在。这些系统使用ARM处理器，与大型计算设备中的传统x86处理器有很大不同。随着设备变得越来越小，对虚拟化的需求也在不断增长，虚拟化提供了诸如能源效率和在多种操作模式下使用设备的能力等好处。虚拟化在系统安全环境中尤其重要，因为许多安全机制都利用虚拟化作为故障遏制和隔离、入侵检测、恶意软件分析以及软件漏洞检测、诊断和修复的核心技术。 为了解决ARM虚拟化的挑战，本项目设计、实现和部署KVM/ARM，一个在Linux操作系统中的开源ARM管理程序。由于传统的x86架构与ARM有很大的不同，因此过去在x86硬件支持虚拟化方面的工作不能转移到ARM上。此外，ARM处理器的差异很大，因为ARM技术的每个许可证持有者都会调整和更改系统软件以满足他们的需求。成功地创建一个适用于各种ARM实现的ARM虚拟机管理程序，为将安全性纳入硬件本身提供了丰富的机会。在主线Linux代码中采用这项研究，可确保在系统安全研究的支持基础上广泛提供功能。