We're sorry but this page doesn't work properly without JavaScript enabled. Please enable it to continue.
Feedback

Intravisor -- a hypervisor for fine-grained isolation using CHERI

Formal Metadata

Title
Intravisor -- a hypervisor for fine-grained isolation using CHERI
Title of Series
Number of Parts
287
Author
License
CC Attribution 2.0 Belgium:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Identifiers
Publisher
Release Date
Language

Content Metadata

Subject Area
Genre
Abstract
Hardware and container virtualisations are the fundamental technologies of modern cloud stacks. While these technologies virtualise different layers of software and hardware, they have one common thing: they are quite inefficient in terms of communication between isolated entities. The isolation relies on MMU and involves a privileged intermediary, which leads to heavy transitions or sharing data at the page granularity. The escape from this trap we see in the hardware capabilities introduced in CHERI. The CHERI architecture efficiently combines hardware memory capabilities with conventional MMU architectures. It gives not only safety to memory pointers, but also provides lightweight isolation mechanisms. In this talk, I will present Introvisor, a lightweight hypervisor for microservices. It uses CHERI capabilities for isolation and data sharing, does not require software porting thus compatible with existing software, and provides strong security guarantees.