Ph.D. - geht es zur Homepage der Informatik des Fachbereiches 3 ...

6.2. Hardware Virtualisation
Again, partitioning is a possible solution for this bandwidth problem. Similar to the scheduling
of processes, this is a temporal scheduling, not of CPU time but of network bandwidth usage.
Temporal slots are defined, which certain services / connections are assigned to. An example
for static temporal partitioning is the Time Triggered Protocol (TTP) [49], which defines fixed
temporal slots for each node on the bus.
The scheduling of network traffic is provided by hardware or by software. An industrial
solution for hardware scheduling of network traffic is, for example, the Avionics Full-Duplex
Ethernet (AFDX) [2], which is a real-time extension for Ethernet in avionic systems. Its main
disadvantage is that additional hardware is needed.
Of course, there exist also open source solutions, like the traffic control (tc) tool for
GNU/Linux, which is a part of the iproute suite [52]. With tc, it is possible to assign
to each network interface a so-called queuing discipline. The default discipline is a simple
first-in-first-out (FIFO) discipline, which does not protect the bandwidth of network interfaces.
A possible solution for bandwith protection is the usage of the Stochastic Fairness Queuing
(SFQ) discipline [52], which is a network traffic scheduler. Like the fair-share scheduler (Subsection
6.2.1.1), the SFQ schedules all network connections in a fair way that no connection can
starve. Unfortunately, the term “stochastic” in its name is misleading because the scheduler
behaviour is deterministic. It divides the network traffic on a certain interface into certain
number n of FIFO queues. Network traffic is assigned to this n FIFO queues by a hash function,
which is chosen in a stochastic way. The n FIFO queues are dequeued by a Round Robin [77,
pp. 457-504] algorithm while here the quantum q [77, pp. 457-504] is not in time but in data
size. This means that the SFQ does not provide temporal partitioning directly, but because
time t, bandwidth b ,and data size s are related by t = s b
with typically b = const it can be
called temporal partitioning anyway.
6.2.2. Minimal Host Operating System
A possible solution for Prob.2 could be the usage of an additional on-top security layer for the
host operating system, such as SELinux for Linux. Its source code would be simple enough to
be validated and certified and it supervises all security functions of the host operating system.
The disadvantage of this solution is that an additional execution layer is added to the host
operating system, which increase the complexity.
Therefore, it the usage of some kind of minimal operating system is proposed here. This
operating system should mainly consist of the hypervisor implementation(s), a scheduler, which
only switches between hypervisor processes and device handle routines, and device drivers and
interfaces. An example for such a minimal host operating system for hardware virtualisation is
LynxSecure [55]. Due to its reduced complexity, it can be validated and certified and then the
host operating system and hypervisors can be assumed to be secure.
6.2.3. Hardware Assisted Virtualisation
This section describes a possible solution for Prob.3 with the usage of hardware assisted
virtualisation. Most modern x86 compatible CPUs provide a support for virtualisation. Hence,
they offer two modes: Host and guest. The host mode is the “normal” mode of a CPU while the
73