TrustVisor: Efficient TCB Reduction and Attestation

TLDR

Legacy systems are vulnerable to malware that can compromise security‑sensitive code, and prior solutions have traded security for efficiency. This work introduces TrustVisor, a hypervisor that leverages modern AMD and Intel processor features to simultaneously achieve high security and high performance. TrustVisor protects sensitive code at fine granularity with a small 6 K‑line code base that enables verification, and it can attest isolated execution to external entities. Implementation of TrustVisor imposes less than 7 % overhead on the legacy OS and its applications in typical use.

Abstract

An important security challenge is to protect the execution of security-sensitive code on legacy systems from malware that may infect the OS, applications, or system devices. Prior work experienced a tradeoff between the level of security achieved and efficiency. In this work, we leverage the features of modern processors from AMD and Intel to overcome the tradeoff to simultaneously achieve a high level of security and high performance. We present TrustVisor, a special-purpose hypervisor that provides code integrity as well as data integrity and secrecy for selected portions of an application. TrustVisor achieves a high level of security, first because it can protect sensitive code at a very fine granularity, and second because it has a very small code base (only around 6K lines of code) that makes verification feasible. TrustVisor can also attest the existence of isolated execution to an external entity. We have implemented TrustVisor to protect security-sensitive code blocks while imposing less than 7% overhead on the legacy OS and its applications in the common case.