TrustVisor: Efficient TCB Reduction and Attestation

An important security challenge is to protect the execution of security-sensitive code on legacy systems from malware that may infect the OS, applications, or system devices. Prior work experienced a tradeoff between the level of security achieved and efficiency. In this work, we leverage the features of modern processors from AMD and Intel to overcome the tradeoff to simultaneously achieve a high level of security and high performance. We present TrustVisor, a special-purpose hypervisor that provides code integrity as well as data integrity and secrecy for selected portions of an application. TrustVisor achieves a high level of security, first because it can protect sensitive code at a very fine granularity, and second because it has a very small code base (only around 6K lines of code) that makes verification feasible. TrustVisor can also attest the existence of isolated execution to an external entity. We have implemented TrustVisor to protect security-sensitive code blocks while imposing less than 7% overhead on the legacy OS and its applications in the common case.

1 Introduction

Current commodity operating systems and applications lack formal assurance that the secrecy and integrity of security-sensitive data are protected. The size and complexity of these systems suggest that we will not achieve the level of assurance necessary to guarantee the absence of security vulnerabilities in these systems in the near future. Even the best-engineered code contains bugs in proportion to its size [24], and available formal methods - while holding great promise for the future - are plagued by scalability challenges. Yet, the convenience and low cost of commodity systems offer unmatched appeal for both users and developers, dictating that security-sensitive workloads will be run on these systems for years to come.