Ph.D. - geht es zur Homepage der Informatik des Fachbereiches 3 ...

Chapter 6. Security in Open Source Software
6.2.1. Bandwidth Protection
As the bandwidth protection of the host system’s hardware resource is of high relevance, possible
solutions for Prob.1 are introduced in this subsection. Unlimited bandwidth consumption
is a possibility to influence or compromise the execution of other implementations over the
boundaries of a VM.
Unfortunately, a general solution for any kind of hardware resource cannot currently be
provided. Nevertheless, a possible solution is the usage of partitioning, which will be described
exemplary for CPUs and network interfaces.
6.2.1.1. Process Scheduling
For a host system, a VM is mainly like a normal process, which is executed, but knowledge
about certain processes in a VM is typically not available in the host. Therefore, partitioning
for the process execution must be done on the host system for the hypervisor process.
As for static memory partitioning (Subsection 6.1.1), the ARINC 653P1-2 requires for
embedded avionics systems the usage of static temporal partitioning [3]. This means a
global sample or cycle time T c is defined, which is divided in n temporal slots s i with i ∈
{0, 1, 2, . . . , n−1}, t i = length(s i ), and T c = ∑ n−1
i=0 t i. Each temporal slot s i is exactly executed
once in one cycle T c for the duration of its execution time t i while a certain process is assigned
to each temporal slot s i . Static temporal partitioning is very robust and and easy to implement
but inflexible and mainly usable in embedded systems.
Process scheduling for multi-process operating systems with a not-fixed number of processes
is far more complex because statical temporal partitioning cannot be used. One important
requirement for the scheduler of the host system is that it behaves – at least partly – deterministically.
Thus, it must be assured that no process starves [77, pp. 457-504]. It exist several
scheduler strategies that are deterministic and avoid starving, but a fair-share scheduler [77,
pp. 457-504] probably fits the requirements the best. It does not only avoid starving of processes
completely and is deterministic but also provides the possibility to group processes while the
execution of these groups is done in a “fair way”. Accordingly, if supplier and open model
implementations are in separated groups, a malicious or faulty supplier implementation could
only influence other supplier implementation in their scheduling.
6.2.1.2. Network Traffic Scheduling
It is not avoidable that processes of the software have to communicate with processes on other
computers or systems and also processes jailed in VMs need access to real network interfaces.
Although this access is never direct, a malicious or faulty implementation could consume too
much network bandwidth by, for example, sending plenty of user datagram protocol (UDP)
packets. This could limit the ability of any other process on the local system – independent
from if it is executed in a VM or not – to transfer data. This problem is mainly related to
network traffic or bandwidth outgoing from the local system because network traffic incoming
to the local system is generated by other computers on the network, which can be hardly
influenced by the retrieving system.
72