55AA Security Lab

55AA-020

Virtualization Methods and Security

Level
Graduate
Status
Under development

Note: this course is still being designed and calibrated; the page content is for reference and does not represent the final teaching version.

Syllabus

Course Overview

Virtualization Methods and Security studies virtual machines, containers, hypervisors, device virtualization, isolation, and cloud security. The course covers mechanisms as well as escapes, side channels, image supply chains, and the boundaries of confidential computing.

This is a graduate systems topic after operating systems, architecture, and system security.

Prerequisites

  • Operating systems, architecture, and system-security fundamentals.
  • Understanding of page tables, interrupts, devices, and privilege levels.
  • Ability to read kernel or hypervisor-related code.

Learning Outcomes

  • Explain CPU, memory, and I/O virtualization mechanisms.
  • Compare isolation boundaries of VMs, containers, and sandboxes.
  • Analyze risk in hypervisors, container runtimes, and image supply chains.
  • Evaluate escapes, side channels, and tenant isolation in cloud environments.
  • Build a virtualization experiment or security-evaluation tool.

Course Format

  • Two meetings per week: one for core concepts and one for labs, paper discussion, or project review.
  • The course proceeds over 16 weeks, each with a checkable assignment, lab, or project milestone.
  • Reproducibility is required: code, configuration, data, lab logs, and reports must be reviewable by staff or peers.

Weekly Plan

Week 1
Week 2

Virtualization goals and isolation models: lab and review

Compare threat models for VMs, containers, and process sandboxes. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 3Virtualization goals and isolation models: lab and review: Concepts, Cases, and Method90 minSession 4Virtualization goals and isolation models: lab and review: Lab, Review, and Transfer90 min
Week 3
Week 4

CPU virtualization and traps: lab and review

Trace a privileged instruction or VM exit. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 7CPU virtualization and traps: lab and review: Concepts, Cases, and Method90 minSession 8CPU virtualization and traps: lab and review: Lab, Review, and Transfer90 min
Week 5
Week 6

Memory virtualization and EPT: lab and review

Analyze nested page tables and isolation cost. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 11Memory virtualization and EPT: lab and review: Concepts, Cases, and Method90 minSession 12Memory virtualization and EPT: lab and review: Lab, Review, and Transfer90 min
Week 7
Week 8

I/O, devices, and interrupt virtualization: lab and review

Evaluate risks in passthrough or emulated devices. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 15I/O, devices, and interrupt virtualization: lab and review: Concepts, Cases, and Method90 minSession 16I/O, devices, and interrupt virtualization: lab and review: Lab, Review, and Transfer90 min
Week 9
Week 10

Containers, namespaces, and cgroups: lab and review

Configure container isolation and test boundaries. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 19Containers, namespaces, and cgroups: lab and review: Concepts, Cases, and Method90 minSession 20Containers, namespaces, and cgroups: lab and review: Lab, Review, and Transfer90 min
Week 11
Week 12

Escapes, side channels, and cloud multi-tenancy: lab and review

Review a virtualization flaw or cloud isolation case. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 23Escapes, side channels, and cloud multi-tenancy: lab and review: Concepts, Cases, and Method90 minSession 24Escapes, side channels, and cloud multi-tenancy: lab and review: Lab, Review, and Transfer90 min
Week 13
Week 14

Images, runtimes, and supply chains: lab and review

Audit images and runtime configuration. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 27Images, runtimes, and supply chains: lab and review: Concepts, Cases, and Method90 minSession 28Images, runtimes, and supply chains: lab and review: Lab, Review, and Transfer90 min
Week 15
Week 16

Confidential computing and limits: lab and review

Submit a virtualization security evaluation report. Complete the paired lab, record issues, and explain design tradeoffs in class review.

Session 31Confidential computing and limits: lab and review: Concepts, Cases, and Method90 minSession 32Confidential computing and limits: lab and review: Lab, Review, and Transfer90 min

Assessment

Individual assignments

Concept questions, reading responses, design tasks, and small programming or lab exercises.

25%
Labs and project

Virtualization experiments, security evaluation, configuration audits, and report.

40%
Participation and review

Participation in discussions, demos, code or paper reviews, and peer feedback.

10%
Final report and defense

Submit reproducible artifacts, a technical report, and a demo explaining methods, results, limitations, and future work.

25%

Course Project

Projects focus on virtualization mechanisms or security boundaries, such as container isolation evaluation, hypervisor experiments, image supply-chain audit, or cloud trust-boundary analysis.

Policies

  • AI tools are allowed, but generated code, lab notes, and design suggestions must be reviewed by the student and disclosed in the report.
  • Students may not submit code, proofs, configuration, or experimental results they cannot explain; each member must defend their own design, tests, and tradeoffs.
  • Late work affects iteration grades, but the course values reproducible, auditable, and maintainable results over last-minute accumulation.

Reference Courses

International

China 985 Universities