Abstract:In JointCloud computing, the hypervisor used by each cloud plays a key role in providing services and protection for guest virtual machines (VMs). Unfortunately, the commodity hypervisor usually has a considerable attack surface and its memory is especially prone to be tampered with by an attacker who resides in one VM and then threatens the security of other co-located VMs. To mitigate such threat, previous solutions proposed an out-of-the-box design which leverages the nested virtualization to introduce a higher privileged software layer (a nested hypervisor) below the hypervisor. It also installs a security monitor into a trusted VM which is protected by the nested hypervisor and isolated from the untrusted hypervisor. The monitor is responsible for dynamically validating the behaviors of the untrusted hypervisor. Although monitoring from outside of the hypervisor can help ensure security, the large number of context switches caused by the nested virtualization incurs unacceptable overheads and makes this approach unsuitable for the cloud environment. In this paper, we introduce In-Hypervisor Memory Introspection (IHMI), an in-the-box way to monitor the hypervisor based on the nested virtualization. Our system puts the monitor into the untrusted hypervisor for efficiency while guaranteeing the same level of memory security as monitoring the hypervisor from a separated secure VM. By leveraging hardware virtualization features of current processors, IHMI isolates the monitor from the hypervisor via the nested page table and implements an efficient switch between them. Further, IHMI configures a uni-directional mapping for the monitor which allows the monitor to access the hypervisor's memory at native speed while forbidding the hypervisor from accessing the monitor's memory. Our IHMI system is currently still in an early stage and we report our design as well as preliminary evaluation results in this paper.

A Container-Oriented Virtual-Machine-Introspection-Based Security Monitor to Secure Containers in Cloud Computing.

Container Introspection: Using External Management Containers to Monitor Containers in Cloud Computing

Virtualization-Based Security Monitoring

Tenant-Oriented Monitoring For Customized Security Services In The Cloud

Agentless and Uniform Introspection for Various Security Services in IaaS Cloud

Decoupling Security Services from IaaS Cloud Through Remote Virtual Machine Introspection

HVSM: an In-OutVM Security Monitoring Architecture in IAAS Cloud

Security Challenges in the Container Cloud

A Node Security Determination Method Based on Container Monitoring

Research on Container-Oriented Isolation Control Technology

A Docker Container Anomaly Monitoring System Based on Optimized Isolation Forest.

ShadowMonitor: An Effective In-VM Monitoring Framework with Hardware-Enforced Isolation

Secure and Efficient In-Hypervisor Memory Introspection Using Nested Virtualization.

Security Analysis and Threats Detection Techniques on Docker Container

Virtualization Security: the Good, the Bad and the Ugly

An In-VM Measuring Framework for Increasing Virtual Machine Security in Clouds

Attacks are Forwarded: Breaking the Isolation of MicroVM-based Containers Through Operation Forwarding

A Lightweight Container Security Framework Adapted to the Power Cloud Platform

A VMM-based Intrusion Prevention System in Cloud Computing Environment

Research and implementation of intelligent monitoring for containerized PaaS

Blockchain-based Automated Container Cloud Security Enhancement System.