White Paper

WHITE PAPER Tactical Virtualization (Tac-V): A New Design Paradigm for Combat Systems mrcy.com 3 emulation. This hardware-enabled virtualization can be used to ensure processing determinism and mitigate interruption (of the application virtual machines (VMs)) or interference by the hypervisor 's own scheduler or other VMs. Modern hypervisors enable VMs to execute directly on bare-metal, without any of the performance impacts of emulation, hypervisor scheduling, and processor over-utilization. A Tac-V architecture goes beyond cloud / enterprise virtualization use cases – which primarily focus on oversubscription and hardware consolidation. Tac-V instead enables hardware consolidation and cyber resiliency of tactical platforms, while ensuring the requisite deterministic performance. Combat System Cyber Resiliency Using a Tac-V architecture minimizes the risk that cyber- attack response actions will negatively impact other subsystems. This unlocks the potential to investigate more aggressive and entirely new response actions that enable combat systems to continue providing required capabilities in the face of cyber-attacks. TAC-V SECURITY CHARACTERISTICS Security Through Separation and Isolation The cornerstone feature of a Tac-V architecture is the ability to decompose software and hardware components into separate and isolated processing domains. Facilitating this is typically a trusted supervisory controller within the processor, like a hypervisor or separation kernel, that configures and controls hardware resources and software execution in order to ensure and maintain the integrity of system operations. This separation ensures software mission loads execute within private enclaves, even though they are running on the same physical processor boards. This helps to address safety and security concerns and improves overall mission assurance – especially given the reality of software vulnerabilities and cyber-attacks. Functional Service Domains Further decomposing the system such that critical services are segregated and isolated into service domains is also important in a Tac-V architecture. Traditional operating systems have limited protections between processes and application/system dependencies. Similarly, the operating system kernel is not separate from the individual device services, thereby increasing the attack surface and enabling a single kernel exploit to compromise the availability of the entire system. A Tac-V architecture enables a new paradigm in which components (services and functions) are isolated via strong, hypervisor- enforced boundaries – ensuring interfaces between components are explicitly controlled. Separating the components improves the overall resiliency of the system as one component can no longer directly or indirectly affect another component. Additionally, partitioning the system into discrete components reduces the collective attack surface, increases overall system security (reduces and/or minimizes privilege escalation, resource starvation, denial of service, etc.), and lays the ground work for future fault tolerant application approaches. Security Service Domains In addition to functional domains, a Tac-V architecture will include security service domains. Several options are available, such as VPN domains, cryptographic service domains, security monitoring domains, and encrypted storage domains. Cryptographic services domains, for example, are often used to provide NSA/NIST certified cryptographic operations to the rest of the platform. Cryptographic services also allow system implementers to choose the most appropriate cryptographic implementation for their deployments without having to make changes to other domains. This flexibility enables developers to cope with changing NSA/NIST cryptographic requirements without having to constantly modify core applications or other system components. Attack Surface Minimization Tac-V prioritizes the use of build systems to remove unneeded features and components from the hypervisor and service domains. Consequently, the deployed system has a significantly reduced software attack space with hardware- enforced security controls. Additionally, the hypervisor can optionally perform runtime integrity monitoring of core service and application VMs. Finally, Tac-V requires the use of security mechanisms to deprivilege domains and restrict them to just provide mission-essential functionality, and nothing more. This makes it even more difficult for an attacker to compromise one domain in order to access another domain. Cyber Resiliency Traditional cyber defenses are often limited to only detecting compromises or patching a systems susceptibility to already- known attacks; however, such technologies are unlikely to stop a determined adversary. Resiliency approaches, on the other

• Cover