Abstract:Cloud computing has completely changed IT (information technology) by providing IT resources as services on the internet. However, certain types of attacks, such as interdependency attacks, impede its wide adoption. With the latter, an attacker who succeeds in compromising the VM of a user can traverse the hypervisor to launch an attack on the VM(s) of other users on the same hypervisor. Unfortunately, we note a lack of secure and performant allocation policies against this problem. Existing policies focus on security but ignore other factors, including workload balance and energy consumption, which are vital for commercial cloud platforms. In this context, we propose different allocation policies for choosing the datacenter server to which we allocate a new virtual machine. These policies aim to minimize the interdependence of different users' VMs while keeping the system performant regarding workload balance and/or power consumption. By default, our allocation policies treat all legitimate users as attackers and host their virtual machines according to their efficiency and coverage. We first design a secure and balanced solution that increases workload balance to prevent the servers from being overused. Afterward, we propose an algorithm that addresses security, power consumption, and workload balance objectives simultaneously. Based on our simulation results, our solutions perform better than existing algorithms regarding security, workload balance, and power consumption. The balanced solution reduces the chance of an attacker to zero and increases workload balance linearly. In other words, the workload balance is between , and it utilizes slightly more hosts than existing proposals, with gains between . Although our final proposal is less secure than previous algorithms, it performs better, so it has a good workload balance ( ) and consumes less energy.

An In-Out-VM measurement architecture against dynamic attacks in clouds

A Virtual Machine Migration Strategy Based on the Relevance of Services Against Side-Channel Attacks

Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

Effectively Mitigating I/O Inactivity In Vcpu Scheduling

SABDTM: Security-first Architecture-Based Dynamic Trusted Measurement Scheme for Operating System of The Virtual Computing Node

A Shared Memory Based Cross-Vm Side Channel Attacks In Iaas Cloud

Investigating Timing Channel in IaaS

Inter-domain Communication Protocol for Real-time File Access Monitor of Virtual Machine

How to Shutdown a Cloud: a DDoS Attack in a Private Infrastructure-As-a-service Cloud.

Analysis of a Secure Virtual Desktop Infrastructure System

Interdependency Attack-Aware Secure and Performant Virtual Machine Allocation Policies With Low Attack Efficiency and Coverage

A Secure Virtual Machine Deployment Strategy to Reduce Co-residency in Cloud

Exploring Virtual Machine Covert Channel Via I/O Performance Interference

On the effectiveness of virtualization-based security

The Application of Virtual Machines on System Security

Exploiting Interfaces of Secure Encrypted Virtual Machines

Retrofitting LBR Profiling to Enhance Virtual Machine Introspection

EPA-RIMM: A Framework for Dynamic SMM-based Runtime Integrity Measurement

Identification and Evaluation of Sharing Memory Covert Timing Channel in Xen Virtual Machines

DDM: A Demand-based Dynamic Mitigation for SMT Transient Channels

A Think on Security and Trusty Measurement for Virtualized Environment