Our Modular Approach

Using type-1 virtualization embodies a fundamental innovation in the delivery of OS functionality: modularity. With a virtualized OS, the hypervisor works with a team of optional cooperating processes that provide higher-level OS functionality. Critically, unlike with a monolithic kernel, these processes run in user space; that is, outside privileged kernel space.

A virtualized architecture is based on the concept of least privilege. Only the kernel is granted access to the entire system. A virtualization tool like the Bedrock Systems Virtualization encapsulates each application and OS service in its own isolated process space. The microkernel protects and allocates memory, and gives drivers and other OS services only the minimum privileges they need to perform their functions.  This is when it leads to us to the ultimate goal of Zero Trust.

Fault containment through isolation and least privilege prevents errors and exploits from affecting other parts of the system. The only thing a component can crash is itself. Such crashes can be easily detected, and, since the virtualization layer is unaffected, the faulty component can be restarted while the system is running with minimal impact on performance. In short, in the event of a kernel crash in a monolithic kernel system the only response is to reboot the system, while with a virtualized system it can usually repair itself to provide a much better mean time between failures (MTBF).

Here is an example of an architectural approach for a modularly designed system: