A Lightweight Security Isolation Approach for Virtual Machines Deployment

详细信息    查看全文

• 作者：Hongliang Liang (16)
  Changyao Han (16)
  Daijie Zhang (16)
  Dongyang Wu (16)
  
  16. Beijing University of Posts and Telecommunications ; Beijing ; China
  
• 关键词：Virtualization ; Hypervisor ; Isolation ; Migration ; Mandatory access control
• 刊名：Lecture Notes in Computer Science
• 出版年：2015
• 出版时间：2015
• 年：2015
• 卷：8957
• 期：1
• 页码：516-529
• 全文大小：1,599 KB
• 参考文献：1. Amazon Web Services. http://aws.amazon.com/cn/
  2. Microsoft Azure. http://azure.microsoft.com/zh-cn/
  3. Google Cloud. https://developers.google.com/cloud/
  4. Grobauer, B, Walloschek, T, Stocker, E (2011) Understanding cloud computing vulnerabilities. IEEE Secur. Priv. 9: pp. 50-57 CrossRef
  5. http://en.wikipedia.org/wiki/Mandatory_access_control
  6. SMACK Project. http://schaufler-ca.com/
  7. http://en.wikipedia.org/wiki/Hypervisor
  8. Xen project. http://www.xenproject.org/
  9. https://www.vmware.com/cn/products/vsphere/features/esxi-hypervisor.html
  10. KVM project. http://www.linux-kvm.org/
  11. Vitrualbox project. https://www.virtualbox.org/
  12. Elhage, N.: Virtunoid: Breaking out of KVM, Black Hat USA (2011)
  13. Azab, A.M., Ning, P., Wang, Z., Jiang, X., Zhang, X., Skalsky, N.C.: HyperSentry: enabling stealthy in-context measurement of hypervisor integrity. In: Proceedings of the 17th ACM Conference on Computer and Communications Security, pp. 38鈥?9 (2010)
  14. Wang, Z., Jiang, X.: HyperSafe: a lightweight approach to provide lifetime hypervisor control-flow integrity. In: Proceedings of the 2010 IEEE Symposium on Security and Privacy, pp. 380鈥?95 (2010)
  15. Zhang, F., Chen, J., Chen, H., Zang, B.: Cloudvisor: retrofitting protection of virtual machines in multi-tenant cloud with nested virtualization. In: Proceedings of the 23th ACM Symposium on Operating Systems Principles, pp. 203鈥?16 (2011)
  16. Steinberg, U., Kauer, B.: NOVA: a microhypervisor-based secure virtualization architecture. In: Proceedings of the 5th European Conference on Computer Systems, pp. 209鈥?22 (2010)
  17. Keller, E, Szefer, J, Rexford, J, Lee, RB (2010) NoHype: virtualized cloud infrastructure without the virtualization. ACM SIGARCH Comput. Archit. News 38: pp. 350-361 CrossRef
  18. Sailer, R., Jaeger, T., Valdez, E., Caceres, R., Perez, R., Berger, S., Griffin, J.L., van Doorn, L.: Building a MAC-based security architecture for the Xen open-source hypervisor. In: Proceedings of the 21st Annual Computer Security Applications Conference, pp. 276鈥?85 (2005)
  19. sVirt project. http://selinuxproject.org/page/SVirt/
  20. Morris, J., Smalley, S., Kroah-Hartman, G.: Linux security modules: general security support for the linux kernel. In: USENIX Security Symposium (2002)
  21. libvirt project. http://libvirt.org/
  22. http://wiki.libvirt.org/page/NBD_storage_migration
  23. https://tools.ietf.org/id/draft-ietf-cipso-ipsecurity-01.txt
  24. http://fedoraproject.org/zh_CN/get-fedora#clouds
  25. SELinuxproject. http://selinuxproject.org/page/Main_Page
  26. http://code.google.com/p/byte-unixbench/
  
• 作者单位：Information Security and Cryptology
• 丛书名：978-3-319-16744-2
• 刊物类别：Computer Science
• 刊物主题：Artificial Intelligence and Robotics
  Computer Communication Networks
  Software Engineering
  Data Encryption
  Database Management
  Computation by Abstract Devices
  Algorithm Analysis and Problem Complexity
  
• 出版者：Springer Berlin / Heidelberg
• ISSN：1611-3349

文摘

Cloud computing has changed the way of IT services; virtualization technology is the foundation of it, which directly affects the security and reliability of the cloud computing platform. From the point of virtualization technology security, we study to integrate mandatory access control mechanism into virtual machines deployment to control resources available for virtual machines, design and implement a lightweight MAC-based strong isolation and migration approach between virtual machines. Experiments show that our method is effective in isolation and migration, and with less performance overload.