Architectures for Secure Cloud Computing Servers

Cloud computing, enabled by virtualization technologies, has rapidly become an important computing paradigm. Economic reasons motivate customers such as companies or governments to use cloud computing and lease virtual machines from third party infrastructure providers. However, by choosing the cloud computing model the customers give up control over the servers on which their code executes and where their data is stored. A compromised or malicious virtualization software layer on the remote servers is the new threat we are worried about. In this dissertation, we propose to leverage server hardware to help provide protections for the code and data executing inside a customer’s virtual machines on the remote cloud servers. The high-level goal is to make code and data executing in a remote virtual machine as secure as if it were executing inside a customer’s own office on a dedicated server. By leveraging hardware, which is almost impossible to modify after production, we can create hardware security architectures that protect the virtual machines. In particular, this dissertation explores a threat that has not been addressed by researchers before – that of an attacker with virtualization layer privileges who can attempt to extract sensitive or confidential code or data from the virtual machines. For example, constantly emerging vulnerabilities and exploits of commercial virtualization software can be utilized by malicious virtual machines to attack the rest of the system via the compromised virtualization layer. The first new research direction that we present is our hypervisor-free virtualization, which is realized in the NoHype architecture. Hypervisor-free virtualization takes a novel approach of removing the need for a virtualization layer during a virtual machine’s runtime. This eliminates the attack surface from potentially malicious virtual machines to the virtualization layer. We thus significantly reduce the attackers’ means for gaining virtualization layer privileges that they could then use to compromise the rest of the system. The hypervisor-free virtualization can be realized on iii Ja k u b S ze fe r, " A rc h it ec tu re s fo r S ec u re C lo u d C o m p u ti n g S er v er s, " P h . D . D is se rt at io n , P ri n ce to n U n iv er si ty , M ay 2 0 1 3 . existing hardware, and we are able to support most of the functionality required for today’s commodity virtual machines. The second new research direction that we present is our hypervisor-secure virtualization, which is realized in the HyperWall architecture. The new hardware in HyperWall allows us to provide more functionality over the first approach. In particular, the architecture supports having an active virtualization layer that can dynamically manage server resources, such as memory allocation for the virtual machines. We also present new hardware attestation mechanisms, called hardware trust evidence, which can be used to help attest to the customer that the protections of their virtual machines are correctly set and enforced. The last part of this dissertation presents a new security verification methodology. Our methodology can be used to help increase confidence in the correctness of hardware-software security architectures. Once the protections are realized in the hardware, they are almost impossible to change and any security bugs would render the system useless. Performing security verification, which is different from functional verification, can help find security bugs and facilitate committing designs to hardware. iv Ja k u b S ze fe r, " A rc h it ec tu re s fo r S ec u re C lo u d C o m p u ti n g S er v er s, " P h . D . D is se rt at io n , P ri n ce to n U n iv er si ty , M ay 2 0 1 3 .