Using a multi-layered protection and detection approach is the only way to ensure systems stay safe. To implement truly secure architectures, you need to lock down and control capabilities in critical system components: this is where the hypervisor’s capabilities come into play. Xen Project sets itself apart as the safest and most reliable hypervisor to use for security-first environments because of its architecture, advanced security features, and an industry-leading security disclosure process.
Xen Project architecture keeps it safe from common vulnerabilities
Xen’s architecture separates the Hypervisor from the Linux Kernel. If there is an attack to the Linux Kernel, it will not impact Xen, like other hypervisors and containers.
In Xen-based systems, it is also possible to run critical elements of the system such as network drivers, QEMU, control software, etc. in a separate VM (sandbox) with restricted privileges defined via the Xen Security Modules. This, together with Xen’s architecture, significantly limits the impact of many classes of security vulnerabilities, ensuring that other parts of the system are not affected by an attack.
Xen Project continued collaboration on advanced security features
The Xen Project is continuing to work with its community to build advanced security features for cloud, server virtualization, embedded and more. A few more recent innovations include:
Virtual Machine Introspection (VMI) is natively supported on both Intel and ARM Chips in the Xen Project hypervisor making it an ideal API for developers building and monitoring security applications. The hardware-assisted VMI protects against intrusion and malware attacks adding an extra layer of security.
KCONFIG gives developers, Xen distributors and system administrators the ability to remove core Xen Hypervisor features at compile time. This ability creates a more lightweight hypervisor and eliminates extra attack surfaces that are beneficial in security-first environments, microservice architectures and environments that have heavy compliance and certification needs, like automotive.
Live Patching enables reboot free deployment of security patches to minimize disruption and downtime during security upgrades for system administrators and DevOps practitioners.
Xen Project security disclosure process built for the distributed nature of the cloud
The Xen Project created a specialized security process called the Cloud Model of Responsible Disclosure that is focused on maximizing transparency and fairness. The model has been adopted by OpenStack, OPNFV, OpenDayLight.
Scale14x: Are today's foss security practices robust enough in the cloud era final from The Linux Foundation
You can learn about the history and process of this approach in this four part series on the Linux.com.
Security Built on the Xen Project hypervisor
| Product | Description |
|---|---|
| Adventium® Labs | Magrana® Server is virtualized server software that provides strong isolation between security enclaves to meet strict separation requirements. |
| AIS | SecureView® is a revolutionary new virtualized platform solution that provides state-of-the-art security, enabling a single workstation to access multiple independent levels of security, and disparate classified networks. |
| Bitdefender HVI | is leveraging the Xen Project hypervisor, Bitdefender and Citrix created the first commercial application for Virtual Machine Introspection (VMI). |
| Bromium vSentry | is software focused on endpoint security. |
| Dornerworks | Virtuosity Hypervisor, a port of the Xen Hypervisor for an embedded environment, is a platform-enabling technology that allows your applications to run with strict partitioning, functional safety, and security from attacks. Virtuosity OA is a variant of Virtuosity that is certified to the Open Group FACE™ Technical Standard. |
| Qubes OS | is a security-oriented, free and open-source operating system for personal computers that allows you to securely compartmentalize your digital life. |
| StarLabs | Crucible Hypervisor built on the Xen Project hypervisor secures embedded virtualization. |
| Zentific | provides endpoint security. |