Hi all,
Together with some other coworkers we have been working on a reference implementation of the security through isolation concept using virtualization. This project is using Xen to provide a contained virtualized environment where malware can run without affecting the whole system.
The goal for this project is to foster the usage of virtualization technology in client platforms (desktops and notebooks) using security as a usage driver. This reference implementation provides certain capabilities which serve as a starting point for the long term goal; some of them are:
- To manage paused Sandbox Virtual Machines ready to be awaken instantaneously to execute suspicious applications
- To destroy and re-open the Sandbox Virtual Machines once the contained suspicious application was closed
Especially, we think that the module which manages the Ready-to-be-executed Sandbox VMs (VM-Pool at Domain 0) may be suitable for other purposes such as high availability of virtual appliances, short-delay responses for highly loaded services, among others; so we'd like to hear from any suggestion on how to adapt it to meet new needs.
We invite you to try the current version of the project Isolated Execution. You can find the code and the documentation about how to compile and install it at Source Forge: http://isolated-exec.sourceforge.net<http://isolated-exec.sourceforge.net/>. Also, at http://isolated-exec.sourceforge.net/?q=node/6, you can find a flash description of what the "early-product" does.
We'd appreciate to receive feedback from the community about the overall concept, and whether you'd like to go deep on any aspect of it. Given that this is a reference implementation and is not complete, we think that the Xen Research Community is the right group to enrich the design and evolve the model. We invite you to post comments/suggestions at http://isolated-exec.sourceforge.net/?q=node/4.
Thanks and see you there!
Guillermo
Together with some other coworkers we have been working on a reference implementation of the security through isolation concept using virtualization. This project is using Xen to provide a contained virtualized environment where malware can run without affecting the whole system.
The goal for this project is to foster the usage of virtualization technology in client platforms (desktops and notebooks) using security as a usage driver. This reference implementation provides certain capabilities which serve as a starting point for the long term goal; some of them are:
- To manage paused Sandbox Virtual Machines ready to be awaken instantaneously to execute suspicious applications
- To destroy and re-open the Sandbox Virtual Machines once the contained suspicious application was closed
Especially, we think that the module which manages the Ready-to-be-executed Sandbox VMs (VM-Pool at Domain 0) may be suitable for other purposes such as high availability of virtual appliances, short-delay responses for highly loaded services, among others; so we'd like to hear from any suggestion on how to adapt it to meet new needs.
We invite you to try the current version of the project Isolated Execution. You can find the code and the documentation about how to compile and install it at Source Forge: http://isolated-exec.sourceforge.net<http://isolated-exec.sourceforge.net/>. Also, at http://isolated-exec.sourceforge.net/?q=node/6, you can find a flash description of what the "early-product" does.
We'd appreciate to receive feedback from the community about the overall concept, and whether you'd like to go deep on any aspect of it. Given that this is a reference implementation and is not complete, we think that the Xen Research Community is the right group to enrich the design and evolve the model. We invite you to post comments/suggestions at http://isolated-exec.sourceforge.net/?q=node/4.
Thanks and see you there!
Guillermo
