Securing guest kernels and enhancing host resource utilization in cloud systems
Creators: name: Vano-Garcia, Fernando
Publisher: name: Zenodo
Year: 2024
Subjects: IaaS
Cloud
Virtualization
Security
Operating Systems
Memory Management

description: Cloud computing has completely changed our lives. This technology is one of the buildingblocks of our modern society and it dramatically impacted on how we play, work and live. It hasbeen widely adopted in many sectors mainly because it reduces the cost of performing tasksin a flexible, scalable and reliable way.However, all of these benefits also come with threats. Since this technology is core for oursociety, it is also a very rewarding target for attackers and therefore it is imperative to havesecure cloud systems.To offer secure cloud services, vendors and providers must safeguard their infrastructure withup-to-date defenses and countermeasures to ensure the provision of high levels of protection,enabling users and consumers to enjoy their services as securely as possible. Unfortunately,the application of certain security mechanisms at infrastructure level can lead to the reductionof the efficient use of hardware resources, such as inefficient memory utilization. Therefore, in some cases security mechanisms cannot be easily combined with other optimizationmechanisms and techniques used to obtain more profit of the existing resources. Whenthis occurs, providers are forced to undertake actions that impact performance and to usetheir resources inefficiently in order to keep security [1–3]. In other cases, priority is given toresource optimization, thereby compromising security [4–6].This thesis makes contributions to overcome existing barriers that prevent the secure andefficient utilization of memory resources in cloud environments.Memory deduplication is an important memory saving technique particularly desired in cloudenvironments because it is capable of reducing memory footprint across virtual machines.Unfortunately, it is known that it can introduce security problems through side channels. Toovercome this problem and to enable the use of the memory saving technique, we proposeSlicedup, a memory deduplication design that prevents side-channel attacks in multi-tenantcloud systems. As described in Chapter 4, Slicedup allows cloud providers to secure the useof memory deduplication, increasing the profit of existing memory resources and decreasingthe total cost of managing and ownership.Kernel randomization is an essential and widely used security technique that consists inplacing kernel memory regions at random locations to hinder the successful exploitation of vulnerabilities that rely on knowing valid addresses. Unfortunately, its use in cloud environmentsproduces alterations in memory contents, leading to a breakage of memory sharing and,consequently, to a higher memory consumption. In Chapter 5, after analyzing the problem andits causes in detail, we propose KASLR-MT, a new kernel randomization design for multi-tenantcloud systems compatible with memory deduplication that maximizes memory savings ratewhile providing a strong security. Afterwards, Chapter 6 presents the evolution and the nextsteps of this security technique, and we extend the effectiveness of KASLR-MT to includesupport for a finer granularity to include protection against info-leaks.Concerning the security of important components of the kernel, the availability of high qualityentropy is critical and necessary to ensure that such security mechanisms operate correctlyand without any weakness that could compromise their effectiveness. Unfortunately, it isunfeasible to generate true randomness by running deterministic algorithms in computers. Asa consequence, obtaining high quality entropy is still a challenge, specially at boot time. InChapter 7, after analyzing the boot-time entropy starvation problem, we propose E-Boot, anovel technique that provides high-quality random numbers to guest virtual machines, beingthe first technique that completely satisfies the entropy demand of virtualized boot-loaders andoperating systems at boot time.As a result of this research, we provide important advantages to the efficiency of environmentsbased on virtualization technologies such as multi-tenant cloud computing systems, whichare the foundation of most of the services we currently use on a daily basis and for which westrongly depend.