White Paper

WHITE PAPER Tactical Virtualization (Tac-V): A New Design Paradigm for Combat Systems mrcy.com 5 programs to address 96% of those requirements. MAPPING CRUCIBLE TO TAC-V Crucible is the only commercially-available virtualization solution specifically designed to aid defense programs in deploying a Tac-V architecture. It addresses all the priorities mentioned above: separation and isolation; service domains; attack surface minimization; cyber resiliency; resource allocation and quality of service; and upgradability. ▪ Separation and Isolation – Crucible::RT operates as a separation kernel / hypervisor to isolate execution domains from each other, rogue peripheral hardware, and the hypervisor itself. This provides the foundation for cyber- attack isolation by preventing errant or malicious code in one domain from being able to read/write memory, manipulate resources, or otherwise affect operations in another domain. Furthermore, the memory protections and mandatory access controls configured by Crucible ensure that the hypervisor itself remains isolated from the execution domains as well as malicious peripheral hardware. The isolation and separation also provide mitigations for a variety of side-channel attacks on the platform. ▪ Service Domains – Crucible includes network and storage domains by default. Also, Crucible makes it easy to isolate underlying hardware and potentially vulnerable drivers, thereby limiting the scope of a potential exploit. Finally, Crucible includes a standard means to facilitate inter- domain communication. This functionality also includes methods for defining and enforcing Mandatory Access Control (MAC) policy to control inter-domain communication. ▪ Attack Surface Minimization – Crucible implements a number of best practices required for high-assurance systems, including comprehensive auditing of system activities, mandatory access control policies, and secure- by-default configuration options. The Crucible build system makes extensive use of KCONFIG in order to remove unneeded features and components from the baseline Xen hypervisor. This enables Crucible to be deployed with a significantly reduced attack space and removes the vast majority of non-essential features and capabilities (such as qemu, memory ballooning, and transcendent memory) which have been the source of software vulnerabilities in the past. Additionally, Mercury is performing a line-by-line traceability exercise of Xen to ensure all of the code maps to low-level requirements, and to provide additional assurances that Crucible::RT is not being deployed with any unnecessary code. This activity further inhibits the introduction of software vulnerabilities into the system. ▪ Cyber Resiliency – Crucible includes functionality to respond to a suspected compromise via fail-over. In cases when fail-over is not possible, Crucible uses snapshot-based reconstitution of compromised services using mechanisms for creating and maintaining trusted snapshots for speedy recovery of failed services. It is also possible, using Crucible, to enable the rapid deployment of other cyber resiliency response actions, such as installing communications filters to block out specific attackers. More advance resiliency solutions might involve the automated diversification and replication of mission-critical applications, with real-time state comparison / vote exchange between the replicas running in parallel. Such an approach would allow for the detection and masking out of inter-replica divergences due to successful cyberattacks. Most importantly, enabling response actions within Crucible minimizes the risk response actions will affect other platform services. ▪ Resource Allocation and Quality of Service – Crucible's Foundry Tools enable pre-defined allocation, provisioning, and non-oversubscription of hardware resources to ensure processing determinism at the VM boundary. This ensures critical applications within each execution domain are able to complete operations without interruption or interference by the hypervisor 's scheduler. Crucible:RT enables real- time operations to continue as normal, unimpeded by the hypervisor. ▪ Upgradability – Crucible assumes the role of hardware compatibility and platform BSP support. This enables domains (VMs) to be upgraded without needing to worry about hardware and driver compatibility. Crucible enables VMs to execute on physical card, while remaining agnostic to the underlying architectural concerns. Additionally, Crucible provides an easy upgrade path for programs not currently utilizing virtualization, and enables a single VM to be created which utilizes all platform resources. In addition to satisfying Tac-V considerations, Crucible also includes capabilities for: ▪ Secure Boot – Crucible's TrueBoot functionality uses a trusted instantiation process to ensure that it will only decrypt and execute sensitive application software within

• Cover