White Paper

WHITE PAPER Tactical Virtualization (Tac-V): A New Design Paradigm for Combat Systems mrcy.com 2 mrcy.com 2 Cyber-attacks against high-value combat management and weapons control systems are a growing concern across the Department of Defense. Approaches to securing and defending safety-critical or mission-critical systems like the AEGIS Weapon System (AWS) and Ship Self- Defense System (SSDS) vary from basic network firewalls to persistent threat monitoring. The past few years has seen a significant up-tick in interest and research into cyber resilience and compromise-tolerance techniques. These techniques seek to increase the survivability of mission critical services in the face of a sophisticated, persistent adversary. Given the significant overlap with existing fault-tolerant principles, many aspects of this problem can be solved through redundancy and diversity. Despite this, a flexible and extensible cyber-resiliency solution – one which can be integrated into both existing and future combat systems with minimal rework – is still necessary. INTRODUCTION One approach to implementing compromise-tolerant systems is to leverage virtualization. Virtualization technologies have matured tremendously over the past decade, with significantly better hardware support and exceptional performance. This maturation has enabled their use in real-time embedded, multi- computer, and server-class processing domains. Additionally, many virtualization technologies, such as Xen, KVM, and OpenVZ are available, i.e., the solutions are open source and they receive significant support from communities comprised of individual developers, government entities, and private sector companies. Finally, virtualization technologies have already been successfully used to implement numerous secure systems, enabling breakthroughs in areas like classified data separation, safety-critical component isolation, attack surface minimization, and moving target defense. An opportunity exists to exploit virtualization technology on tactical hardware to achieve considerable security and maintenance benefits with little to no performance impact. This approach, referred to as Tactical Virtualization (Tac-V), can be used to create secure, resilient, and easily upgradable combat platforms. Tac-V separates platform functionality and services into isolated execution domains. This allows underlying hardware and potentially vulnerable services to be segregated, thereby limiting the scope of a potential compromise. Additionally, these domains can be reduced to include only the minimally required functionality and interfaces – thereby reducing each domain's attack surface and providing the ability to perform quicker restart and migration. In addition to limiting and containing an attacker, this also enables an architecture in which individual services can be easily reconstituted and upgraded with limited impact to other components which rely on those services. As such, a software- defined architecture emerges. To achieve these benefits, a lightweight hypervisor serves as a trusted supervisory controller and separation kernel within the processor – configuring and controlling hardware resources and software execution in order to ensure and maintain the integrity of system operations. TAC-V BENEFITS Isolated Service Domains Tac-V calls for dividing functionality into lightweight service domains with well-defined boundaries. This micro- disaggregation approach provides the foundation for cyber- attack isolation (risk mitigation) and resiliency by preventing errant or malicious code in one domain from being able to read/write memory, manipulate resources, or otherwise affect operations in another domain. Furthermore, memory protections and mandatory access controls ensures that the hypervisor itself remains isolated from the execution domains as well as malicious peripheral hardware. Virtualization Without Performance Impacts The barrier most often cited for adopting virtualization is performance. Modern processors, however, come standard with ample computing resources and hardware virtualization extensions enabling a hypervisor to control the allocation and subscription of system resources without requiring hardware

• Cover