2 research outputs found
Insider threat : memory confidentiality and integrity in the cloud
PhD ThesisThe advantages of always available services, such as remote device backup or data storage,
have helped the widespread adoption of cloud computing. However, cloud computing services
challenge the traditional boundary between trusted inside and untrusted outside. A
consumer’s data and applications are no longer in premises, fundamentally changing the
scope of an insider threat.
This thesis looks at the security risks associated with an insider threat. Specifically, we
look into the critical challenge of assuring data confidentiality and integrity for the execution
of arbitrary software in a consumer’s virtual machine. The problem arises from having
multiple virtual machines sharing hardware resources in the same physical host, while an
administrator is granted elevated privileges over such host.
We used an empirical approach to collect evidence of the existence of this security problem
and implemented a prototype of a novel prevention mechanism for such a problem.
Finally, we propose a trustworthy cloud architecture which uses the security properties our
prevention mechanism guarantees as a building block.
To collect the evidence required to demonstrate how an insider threat can become a
security problem to a cloud computing infrastructure, we performed a set of attacks targeting
the three most commonly used virtualization software solutions. These attacks attempt to
compromise data confidentiality and integrity of cloud consumers’ data. The prototype to
evaluate our novel prevention mechanism was implemented in the Xen hypervisor and tested
against known attacks.
The prototype we implemented focuses on applying restrictions to the permissive memory
access model currently in use in the most relevant virtualization software solutions. We
envision the use of a mandatory memory access control model in the virtualization software.
This model enforces the principle of least privilege to memory access, which means
cloud administrators are assigned with only enough privileges to successfully perform their
administrative tasks.
Although the changes we suggest to the virtualization layer make it more restrictive, our
solution is versatile enough to port all the functionality available in current virtualization
viii
solutions. Therefore, our trustworthy cloud architecture guarantees data confidentiality and
integrity and achieves a more transparent trustworthy cloud ecosystem while preserving
functionality.
Our results show that a malicious insider can compromise security sensitive data in the
three most important commercial virtualization software solutions. These virtualization solutions
are publicly available and the number of cloud servers using these solutions accounts
for the majority of the virtualization market. The prevention mechanism prototype we designed
and implemented guarantees data confidentiality and integrity against such attacks
and reduces the trusted computing base of the virtualization layer. These results indicate
how current virtualization solutions need to reconsider their view on insider threats