We had talk about Qubes OS and now, I want to share dome information about its architecture.
Qubes implements a Security by Isolation approach. To do this, Qubes utilizes virtualization technology in order to isolate various programs from each other and even to sandbox many system-level components, such as networking and storage subsystems, so that the compromise of any of these programs or components does not affect the integrity of the rest of the system.
Qubes lets the user define many security domains, which are implemented as lightweight Virtual Machines (VMs), or “AppVMs.” For example, the user can have “personal,” “work,” “shopping,” “bank,” and “random” AppVMs and can use the applications within those VMs just as if they were executing on the local machine. At the same time, however, these applications are well isolated from each other. Qubes also supports secure copy-and-paste and file sharing between the AppVMs, of course.
(Note: In the diagram above, “Storage domain” is actually a USB domain.)
Key Architecture features
Based on a secure bare-metal hypervisor (Xen)
Networking code sand-boxed in an unprivileged VM (using IOMMU/VT-d)
USB stacks and drivers sand-boxed in an unprivileged VM (currently experimental feature)
No networking code in the privileged domain (dom0)
All user applications run in “AppVMs,” lightweight VMs based on Linux
Centralized updates of all AppVMs based on the same template
Qubes GUI virtualization presents applications as if they were running locally
Qubes GUI provides isolation between apps sharing the same desktop
Qubes OS has wonderful architecture for delivering virtual applications in a secured and isolated environment to each user.
Share
Davoud Teimouri
Professional blogger, vExpert 2015/2016/2017/2018/2019/2020/2021/2022/2023, vExpert NSX, vExpert PRO, vExpert Security, vExpert EUC, VCA, MCITP. This blog is started with simple posts and now, it has large following readers.
