SIVSHM: Secure Inter-VM Shared Memory

With wide spread acceptance of virtualization, virtual machines (VMs) find their presence in various applications such as NAT servers, firewall servers and MapReduce applications, where a data manager collects data from the external world and distributes it to multiple workers for further processing. Currently, application managers can share data with workers either using network or inter-VM shared memory (IVSHMEM). Network provides security due to isolation at the cost of reducing throughput and IVSHMEM provides better throughput sacrificing security as manager and untrusted workers have full access to the shared memory region. SIVSHM solves the security problem by segmenting inter-VM shared memory, so that manager has access to all the segments and each worker has access to segment that belongs only to it, thereby enabling security without sacrificing throughput. Secondly, IVSHMEM uses a central distributor to exchange eventfd – a file descriptor to an event queue of length one, which is used for inter-VM signaling. Central distributor becomes a bottleneck and increases boot time of VMs. SIVSHM enables direct exchange of eventfds amongst VMs eliminating the need for an eventfd distributor per service reducing boot time of a service to (7/10)th compared to IVSHMEM.