Startup offers rootkit protection, partitioning

Integrity Global Security platform used in military fighters
  • Tim Greene (Network World)
  • 21 November, 2008 07:48

Although it uses different terminology, start-up Integrity Global Security is coming out with a businesses version of technology used on military fighters and bombers that can provide the features of virtual machines but with built-in security.

Called Integrity, the software runs on PC and server hardware, and creates secure partitions in which conventional operating systems can run.

The company is a wholly owned subsidiary of Green Hill Software, which has been selling Integrity to the military and other government agencies for years. The difference is that Integrity Global Security will sell to businesses the software that has been deployed in weapons systems aboard the B-1B bomber, and F-16, F-22 and F-35 fighters.

The software is a component of systems and networks that require that varying levels of classified data be insulated from each other but also that controlled interactions be allowed to accomplish tasks. In the business world, Integrity Global Security will sell Integrity to businesses concerned about the confidentiality of their resources and the reliability of their servers and desktops.

The software is analogous to a virtual-machine hypervisor in that it is not an operating system but an abstraction layer that sits between the hardware and the operating systems running on the hardware. The difference, the company says, is that Integrity provides a buffer layer that protects the operating systems on top of it from malware that may have infected the basic hardware below. This would guard against so-called Blue Pills, malicious software that controls a hypervisor. The Blue Pill also simulates the underlying hardware so the hypervisor is unaware of the Blue Pill; it thinks it is running on the hardware.

Integrity also securely partitions the virtual environments running on top of it from each other. Integrity partitions are called padded cells; they can be configured to allow communication with certain cells but not with others. In virtual-machine parlance, this is like building in virtual firewalls that insulate one virtual machine from others in accordance with a corporate rule set.

This feature has proven itself useful in military agencies that have a hierarchy of security profiles for applications, says Integrity Global Security CEO David Chandler. Integrity can be used to ensure that applications ranked secret are in padded cells that can't access applications ranked top secret that are hosted in other padded cells, for instance, he says.

The platform has already been sold by Green Hill Software and deployed on military aircraft to partition onboard systems, Chandler says. Integrity has earned a lengthy list of government and industry security standards, most recently a ranking by the international Common Criteria Agreement organization that says the platform can "protect high-value assets from significant risks." This has earned it an evaluation assurance level of EAL6+.

Page Break

In conventional virtual environments, firewalls by such vendors as Altor Networks, Check Point Software and Stonesoft can be added to shore up security among virtual machines. Integrity builds in this capability: It supports partitioned management of padded cells, so administrators with different clearance levels can manage cells appropriate to their security level. It also partitions CPU capacity so a certain number of cycles can be reserved for highest-priority tasks regardless of the demand of lower-priority tasks running off the same CPU, the company says.

Integrity can tie into the security built into Intel vPro processors that detect when the boot process of a machine has been tampered with, and so detect rootkits, Chandler says.

Future work on the platform includes collaboration with third parties to create a secure Web interface directly from Integrity. Communications between two Integrity machines can be secured, Chandler says.

Integrity Global Security will sell to businesses via third-party integrators and other partners, but initially will sell direct to customers. Pricing has not been set.