Abstract:The prevalence of Cloud Computing has appealed many users to put their business into low-cost and flexible cloud servers instead of bare-metal machines. Most virtual machines in the cloud run commodity operating system(e.g., linux), and the complexity of such operating systems makes them more bug-prone and easier to be compromised. To mitigate the security threats, previous works attempt to mediate and filter system calls, transform all unpopular paths into popular paths, or implement a nested kernel along with the untrusted outter kernel to enforce certain security policies. However, such solutions only enforce read-only protection or assume that popular paths in the kernel to contain almost no bug, which is not always the case in the real world. To overcome their shortcomings and combine their advantages as much as possible, we propose a hardware-assisted isolation mechanism that isolates untrusted part of the kernel. To achieve isolation, we prepare multiple restricted Extended Page Table (EPT) during boot time, each of which has certain critical data unmapped from it so that the code executing in the isolated environment could not access sensitive data. We leverage the VMFUNC instruction already available in recent Intel processors to directly switch to another pre-defined EPT inside guest virtual machine without trapping into the underlying hypervisor, which is faster than the traditional trap-and-emulate procedure. The semantic gap is minimized and real-time check is achieved by allowing EPT violations to be converted to Virtualization Exception (VE), which could be handled inside guest kernel in non-root mode. Our preliminary evaluation shows that with hardware virtualization feature, we are able to run the untrusted code in an isolated environment with negligible overhead.

Chinese Wall Isolation Mechanism and Its Implementation on VMM

A Security-Awareness Virtual Machine Management Scheme Based on Chinese Wall Policy in Cloud Computing.

Pcanel/V2: A VMM Architecture Based on Intel VT-x

Design and Implementation of SecPod, A Framework for Virtualization-Based Security Systems.

A BLP-Based Access Control Mechanism for the Virtual Machine System

PVM: A Memory Management under Vertical Architecture

SeVMM: VMM-Based Security Control Model

The Application of Virtual Machines on System Security

Tsac: Enforcing Isolation of Virtual Machines in Clouds

Security Analysis of Virtual Machine Monitor

An Approach for Secure-Communication Between XEN Virtual Machines

A Security-Awareness Virtual Machine Placement Scheme in the Cloud

Undertow: an Intra-Kernel Isolation Mechanism for Hardware-Assisted Virtual Machines.

Identification and Evaluation of Sharing Memory Covert Timing Channel in Xen Virtual Machines

Enhanced Privilege Separation for Commodity Software on Virtualized Platform

Two Optimization Mechanisms to Improve the Isolation Property of Server Consolidation in Virtualized Multi-core Server.

Exploring Virtual Machine Covert Channel Via I/O Performance Interference

One-Way Isolation Execution Model Based on Hardware Virtualization

Isolate Secure Executing Environment for a Safe Cloud.

Transparent Driver-Kernel Isolation with VMM Intervention

SEMMA: Secure Efficient Memory Management Approach in Virtual Environment.