Virtual Disk Integrity in Real Time
summary
Real-time monitor extends Xen's block tap2 and VHD format to track per-block hashes so Dom0 can verify reads and writes without running code in the guest. It stores a per-sector SHA1 list inside an added VHD header (encrypted and kept in the protected /config partition), computes hashes on reads and updates on completed writes, and commits the hash table at VM shutdown. Prototype supports dynamic VHDs, reports integrity checks on read, uses extensions to Xen block tap2, and shows minimal synchronous I/O overhead in basic benchmarks.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:47security vs. performance
- 2:22xenclient xt
- 3:31xt layout
- 4:24xt - measuring process
- 4:54tripwire
- 5:29inotify
- 7:21vdirt design
- 8:33vdirt ops summary
- 9:18a typical blktap call
- 10:39vhd - blocks and sectors
- 11:30vdirt vhd structure
- 15:44protecting vdirt
- 18:14limitations
related talks
32mLVBS and Advanced Kernel Integrity
23mHyper-V's Virtual Secure Mode in KVM project update
47mLinux Virtualization Based Security
12mSecurity and Performance in the Delegated User-level Virtualization
19mSupporting Trusted Virtual Machines with Hardware-based Secure Remote Memory
20mIntel Virtualization Technology Extensions to Enable Hardware Isolated VMs
26mHypervisor Based Integrity: Protect Guest Kernel in Cloud
54mPoacher Turned Gamekeeper: Lessons Learned from Eight Years of Breaking Hypervisors