Using hypervisor to provide data secrecy for user applications on a per-page basis

Hypervisors are increasingly utilized in modern computer systems, ranging from PCs to web servers and data centers. Aside from server applications, hypervisors are also becoming a popular target for implementing many security systems, since they provide a small and easy-to-secure trusted computing base. This paper presents a novel way of using hypervisors to protect application data privacy even when the underlying operating system is not trustable. Each page in virtual address space is rendered to user applications ac-cording to the security context the application is running in. The hypervisor encrypts and decrypts each memory page requested de-pending on the application’s access permission to the page. The main result of this system is the complete removal of the operating system from the trust base for user applications ’ data privacy. To reduce the runtime overhead of the system, two optimization tech-niques are employed. We use page-frame replication to reduce the number of cryptographic operations by keeping decrypted versions of a page frame. We also employ lazy synchronization to minimize overhead due to an update to one of the replicated page frame. Our system is implemented and evaluated by modifying the Xen hyper-visor, showing that it increases the application execution time only by 3 % for CPU and memory-intensive workloads