[2020] Hypervisor Based Integrity: Protect Guest Kernel in Cloud by Ning Yang & Forrest Yuan Yu

There are multiple efforts from the community that tries to bring Virtualization based security into the industry and there are a number of papers published every year to discuss the benefit of this approach. Hypervisor Based Integrity(HBI) is product Google Cloud is currently investing to be the public offering for such security hardening in the Cloud. The talk will cover the place where this implementation fits in the Cloud environment, the relationship between this mechanism and other security enhancement for the Linux kernel, what HBI can protect/monitor, special challenges encountered along the road. In addition, it will also cover an overview of the new hypervisor security kernel module Google plans to upstream and show how all hypervisor/VMM can easily implement the support for it so guest VM can move across different providers while getting the same security guarantee.

---

Ning Yang
Google Inc, Senior Software Developer

Ning is a Senior Software Developer at Google Compute Infrastructure Team. He contributes to Google internal VMM, including device emulation and guest firmware/driver support. Worked on bringing UEFI(OVMF) into Google Cloud and the Google Cloud Shielded VM project, which provides secure boot support and security monitoring as the measured boot.

Forrest Yuan Yu
Google Inc, Software Developer

Forrest is a software engineer at Google working on firmware, virtualization and making GCP more secure for customers.