iKernel: Isolating Buggy and Malicious Device Drivers Using Hardware Virtualization Support

The users of today's operating systems demand high reliability and security. However, faults introduced outside of the core operating system by buggy and malicious device drivers can significantly impact these dependability attributes. To help improve driver isolation, we propose an approach th...

Full description

Saved in:
Bibliographic Details
Main Authors: Lin Tan, Chan, E.M., Farivar, R., Mallick, N., Carlyle, J.C., David, F.M., Campbell, R.H.
Format: Conference Proceeding
Language:eng ; jpn
Subjects:
Hardware
Kernel
Operating systems
Platform virtualization
Protection
Security
Virtual machine monitors
Virtual machining
Virtual manufacturing
Virtual prototyping
Online Access:Request full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:The users of today's operating systems demand high reliability and security. However, faults introduced outside of the core operating system by buggy and malicious device drivers can significantly impact these dependability attributes. To help improve driver isolation, we propose an approach that utilizes the latest hardware virtualization support to efficiently sandbox each device driver in its own minimal virtual machine (VM) so that the kernel is protected from faults in these drivers. We present our implementation of a low-overhead virtual-machine based framework which allows reuse of existing drivers. We have constructed a prototype to demonstrate that it is feasible to utilize existing hardware virtualization techniques to allow device drivers in a VM to communicate with devices directly without frequent hardware traps into the virtual machine monitor (VMM). We have implemented a prototype parallel port driver which interacts through iKernel to communicate with a physical LED device.
DOI:10.1109/DASC.2007.16