Virtualization in Multilevel Security Environments Dr. Christoph Schuba
[email protected] http://blogs.sun.com/schuba 1 Agenda • Using OS Virtualization to Build MLS Architecture > OS Virtualization > Labeled Local and Remote File Systems > Trusted Desktop • Overview Trusted VirtualBox • What We Can Do Today • What We Can Do Tomorrow - 2 - Agenda • Using OS Virtualization to Build MLS Architecture > OS Virtualization > Labeled Local and Remote File Systems > Trusted Desktop • Overview Trusted VirtualBox • What We Can Do Today • What We Can Do Tomorrow - 3 - Virtualization Technologies • Type 1 - Hypervisor-based virtualization > xVM - style (think XEN) > Logical Domains (LDOM) - firmware-style, Sparc CMT • OS virtualization > Containers (aka Zones), both x64 and Sparc • Type 2 - Hypervisor-based virtualization • Desktop and network virtualization > Sunray, VDI, Crossbow, ... • Combinations! - 4 - Server Virtualization Categories Hard Partitions Virtual Machines OS Virtualization Resource Mgmt. App OS Server Multiple OS Single OS > Very High RAS > Ability to live migrate > Very scalable and low > Very scalable and low an OS overhead overhead > Very Scalable > Ability to run different > Single OS to manage > Single OS to manage > Mature Technology OS versions and types > Cleanly divides system > Fine grained resource > Ability to run different > De-couples OS and and application management OS versions HW versions administration > Fine grained resource management - 5 - Virtualization Virtualization is the idea to introduce an abstraction layer that decouples previously adjacent layers to deliver greater resource utilization and flexibility. • Layers? > application, operating system, network, storage, file system, memory, resources, etc. - 6 - A Word About the Software • Solaris vs. OpenSolaris > Initially Developer Focus, soon Enterprise > Free > Open Source > Superior prototyping Environment for Security Research – virtualization technologies, – process privileges, – fault and service management, – open storage, especially ZFS – cryptographic framework, etc.