White Paper

WHITE PAPER Tactical Virtualization (Tac-V): A New Design Paradigm for Combat Systems mrcy.com 4 hand, aim to ensure that mission critical services and data are immutable – even in the face of an ongoing targeted attack. This is accomplished by not only anticipating adversary maneuvers, but also by withstanding successful compromises through cyber fault tolerant techniques, recovering critical assets through rapid reconstitution, and evolving and adapting to the threat through anomaly detection and moving target defense. A Tac-V architecture leverages existing fault-tolerant protocols and recovery techniques to ensure functional and security service domains overcome / respond to / and recover from suspected compromise. Resource Allocation and Quality of Service A Tac-V architecture also facilitates the allocation of system resources to ensure performance. It provides pre- defined allocation and nonoversubscription of hardware resources to ensure processing determinism at the VM boundary. This ensures critical applications within each execution domain are able to complete operations without interruption or interference by the hypervisor 's scheduler or other VMs. This architecture also enables any real-time operations and thru-data paths to continue as normal, unimpeded by the hypervisor and the rest of the system. These techniques have the added benefit of ensuring that compromised service domains cannot be used to execute a denial of service (DoS) attack by monopolizing processing resources. Software Upgradability To meet evolving mission and security requirements, a Tac-V architecture also includes an interface to facilitate efficient and secure upgrades to the hypervisor, service domains, and cryptographic support functions. Software updates are required to use approved public- key cryptography, as well as on-platform cryptographic services and replay prevention techniques to ensure that new software loads are trusted and current before performing the upgrade. These techniques prevent attackers from downgrading the system to software versions with known vulnerabilities or subverting the trustworthiness of the overall platform. The verification of updates (and rapid recovery) provides an additional failback mechanism to prevent botched system upgrades from disconnecting the platform. MERCURY'S TAC-V SOLUTION Mercury 's Crucible embedded virtualization product allows programs to implement a Tac-V architecture within combat systems. Crucible consists of Trueboot (trusted boot component designed for commodity Intel processors), RelianceOne Linux Security Suite (operating system hardening, mandatory access control, technology protection, data-at-rest protections), and the Crucible::RT hypervisor (secure tactical virtualization built from Xen). The Crucible Security Suite is a technical readiness level (TRL) 9 solution that provides proven security, from encryption-at-rest, through secure boot, and during software execution. The core of the Crucible Security Suite, Crucible::RT, is derived from the Xen Project hypervisor. The Xen hypervisor has hundreds of billions of hours of operational use across cloud, enterprise and high- performance computing (HPC) environments. Crucible leverages Intel and ARM hardware features to partition, isolate, and secure a COTS platform. All of the Crucible components utilize existing, well-supported API interfaces within the kernel, hypervisor, and boot platform. The use of established, well-supported APIs decreases the cost and minimizes the effort to support older/newer kernel versions, enabling broader adoption by customers. Further, Crucible is designed for easy integration into existing program production processes, with feature-rich tooling that makes using it intuitive and straightforward. Finally, Crucible is maintained as a commercial product independent and external to program funding, with major releases every 6-months. New features and functionality are continuously being developed at no additional cost to programs. Crucible and RelianceOne support most Intel / ARM architectures. Additionally, Crucible / RelianceOne supports all Linux distributions currently in use across DOD and its contractors, including real-time variants of Linux. Support for non-Linux VMs such as VxWorks or Windows within Crucible::RT is also supported on a per-program basis. Crucible, which includes RelianceOne is certifiable as a MILS separation kernel, and is additionally capable of being certified as a CSFC solution. Mercury is currently pursuing (and is under contract with an accredited evaluation laboratory) for the evaluation of Crucible / RelianceOne against a total of 6- distinct NIAP protection profiles and expects to have full government approval in Q4 of 2019. These 6 protection profiles will enable Crucible to be used for: 1) MILS Separation kernel / Hypervisor; 2) CSFC Data-at-rest (file-based encryption for Linux); and 3) CSFC Data-At-Rest (software full disk encryption for Linux). In addition to the NIAP profiles, Mercury also maintains a comprehensive IA / Cybersecurity mapping of Crucible / RelianceOne against the NIST 800-53 risk management framework (RMF) requirements and enables

• Cover