5 ms·

Look at OKL4 or Nova microhypervisor for what a microkernel version of Xen would look like. Xen is relatively large with pile of monolithic code in dom0. Microk

Look at OKL4 or Nova microhypervisor for what a microkernel version of Xen would look like. Xen is relatively large with pile of monolithic code in dom0. Microkernel vendors, esp OK Labs, were poking at its huge TCB for a while.

naasking 9y ago
Thanks for reminding about NOVA! I had totally forgotten about it. Doesn't seem to have much activity since 2010 though, unfortunately. I wonder why Google does't just build on L4 or something like Nova instead of starting from scratch. These systems are low-level and general enough to do what they want, possibly better than they could achieve themselves. L4-sec has had 2 decades of research put into it, 3 decades if you count is predecessor L3.
- nickpsecurity 9y ago
  I said same thing. I went further to say they shouldve bought OK Labs to get one of best combos of team and tech. It already worked with Android, too. Far as NOVA, here's the dissertation that goes into a lot more detail on design considerations than most of the whitepapers. https://www.researchgate.net/publication/275031217_Improving_System_Security_Through_TCB_Reduction https://www.researchgate.net/publication/275031217_Improving... Of course, the number of hardware and firmware type of attacks on mainstream platforms made NSA retire the SKPP for doing separation on them. Even a perfect hypervisor cant be trusted to maintain that when its dependencies are garbage. That was even noted in 1992-1993 papers on VAX Secure VMM. Even secure digital desigms might have analog or RF attacks. So, the current recommendation is to build things that way just to reduce number of attacks with monitoring and recovery as usual. Those two, though, could run on simpler, verified platforms. There's a lot of precedent for such split architectures.

5 ms·

Look at OKL4 or Nova microhypervisor for what a microkernel version of Xen would look like. Xen is relatively large with pile of monolithic code in dom0. Microk

by nickpsecurity 9y ago

naasking 9y ago
Thanks for reminding about NOVA! I had totally forgotten about it. Doesn't seem to have much activity since 2010 though, unfortunately. I wonder why Google does't just build on L4 or something like Nova instead of starting from scratch. These systems are low-level and general enough to do what they want, possibly better than they could achieve themselves. L4-sec has had 2 decades of research put into it, 3 decades if you count is predecessor L3.
- nickpsecurity 9y ago
  I said same thing. I went further to say they shouldve bought OK Labs to get one of best combos of team and tech. It already worked with Android, too. Far as NOVA, here's the dissertation that goes into a lot more detail on design considerations than most of the whitepapers. https://www.researchgate.net/publication/275031217_Improving_System_Security_Through_TCB_Reduction https://www.researchgate.net/publication/275031217_Improving... Of course, the number of hardware and firmware type of attacks on mainstream platforms made NSA retire the SKPP for doing separation on them. Even a perfect hypervisor cant be trusted to maintain that when its dependencies are garbage. That was even noted in 1992-1993 papers on VAX Secure VMM. Even secure digital desigms might have analog or RF attacks. So, the current recommendation is to build things that way just to reduce number of attacks with monitoring and recovery as usual. Those two, though, could run on simpler, verified platforms. There's a lot of precedent for such split architectures.