zlacker

[parent] [thread] 1 comments
1. rdl+(OP)[view] [source] 2011-06-12 10:03:52
There has been a lot of work out there on how to use a "separation kernel" (basically, a hypervisor with proven/provable levels of isolation between guests), plus stuff like Intel's VT-d, VT-x, etc., to provide real isolation between guests. (also, really useful for RTOS and embedded systems)

If you've ever worked in a high security computing environment, you've had N workstations on your desk, where N is often approaching 5 -- NIPR, SIPR, JWICS, various task-specific machines, etc. These environments aren't just nice air conditioned purpose-built offices in the US; they're tents in Afghanistan, on aircraft and cramped warships, etc.

Sometimes people use KVM switches, but even then, you need separate hosts, and it's usually best to use multiple monitors and keyboards anyway.

Invisible Things was has been testing the limits of current hypervisors, and there's room for them to both work on what is possible once a real separation kernel exists (now) in prototype form, and to continue to refine hypervisors and develop a real separation kernel.

I'm still kind of amazed that these 2-4 people in Poland are probably the world's foremost experts on hypervisor security.

replies(1): >>sbierw+X
2. sbierw+X[view] [source] 2011-06-12 10:59:45
>>rdl+(OP)
N=6, here.

https://secure.wikimedia.org/wikipedia/en/wiki/File:Intel_Gr...

[go to top]