This start-up project is being provided financial support in the framework of KIT's excellence initiative. It is concerned with isolating operating systems in order to separate applications of differing sensitivity or risk from one another. This approach is supposed to provide a user the opportunity to isolate those applications that might be expected to be subject to malware attacks from particularly confidential data. Similarly, users can isolate their normal office environment from potentially unreliable applications. The topic to be addressed in the project in this regard is the "compartmentalization" approach. This is concerned with the creation of compartments within which operating systems run, each of which has a virtual machine at its disposal. Thus, they run only indirectly on the actual hardware, whose resources they share - transparently, from their perspective - with other programs in other compartments. This approach also facilitates the update of software because it makes it easy to back up the system status and to reinstate it if there are problems following an update. A single application such as home banking or a virus scanner could, by the way, be run on a "lite" version of Linux instead of on a full version of Windows.

It is in principle relatively simple to build a system for compartmentalization. Such systems are available under the designations "hypervisor" and "virtual machine monitor". There are large problems in building a system supporting highly secure isolation that offers protection against every form of malware yet at the same time has interfaces to existing applications and to new peripheral devices. ITAS was a participant in the EU project Open Trusted Computing, in which the possibility to solve these problems was demonstrated by a prototype.

The security and user friendliness of this and other prototypes and products are supposed to be examined in the start-up project. Further topics will be additional technical options and their respective advantages and disadvantages, such as the use of hardware protected against manipulation in order to protect the user or an employer (as legal owner) against, for example, false updates.

In the project a web site will be built for background information on the problems and possible solutions. Later we want to make it possible for there to be a dialogue with stakeholders. The project is being conducted by ITAS jointly with the Institute of Cryptography and Security (IKS) of KIT.

Project website: www.open-hypervisor.org