36 research outputs found
Deploying Virtual Machines on Shared Platforms
In this report, we describe mechanisms for secure deployment of virtual machines on shared platforms looking into a telecommunication cloud use case, which is also presented in this report. The architecture we present focuses on the security requirements of the major stakeholders’ part of the scenario we present. This report comprehensively covers all major security aspects including different security mechanisms and protocols, leveraging existing standards and state-of-the art wherever applicable. In particular, our architecture uses TCG technologies for trust establishment in the deployment of operator virtual machines on shared resource platforms. We also propose a novel procedure for securely launching and cryptographically binding a virtual machine to a target platform thereby protecting the operator virtual machine and its related credentials
Protecting Private Data in the Cloud
Companies that process business critical and secret data are reluctant
to use utility and cloud computing for the risk that their data gets
stolen by rogue system administrators at the hosting company. We
describe a system organization that prevents host administrators from
directly accessing or installing eaves-dropping software on the
machine that holds the client's valuable data. Clients are monitored
via machine code probes that are inlined into the clients' programs at
runtime. The system enables the cloud provider to install and remove software
probes into the machine code without stopping the client's program, and
it prevents the provider from installing probes not granted by the
client
TCG based approach for secure management of virtualized platforms: state-of-the-art
There is a strong trend shift in the favor of adopting virtualization to get business benefits. The provisioning of virtualized enterprise resources is one kind of many possible scenarios. Where virtualization promises clear advantages it also poses new security challenges which need to be addressed to gain stakeholders confidence in the dynamics of new environment. One important facet of these challenges is establishing 'Trust' which is a basic primitive for any viable business model. The Trusted computing group (TCG) offers technologies and mechanisms required to establish this trust in the target platforms. Moreover, TCG technologies enable protecting of sensitive data in rest and transit. This report explores the applicability of relevant TCG concepts to virtualize enterprise resources securely for provisioning, establish trust in the target platforms and securely manage these virtualized Trusted Platforms
Trusted Launch of Virtual Machine Instances in Public IaaS Environments
Cloud computing and Infrastructure-as-a-Service (IaaS) are emerging
and promising technologies, however their adoption is hampered by data security
concerns. At the same time, Trusted Computing (TC) is experiencing an increasing
interest as a security mechanism for IaaS. In this paper we present a protocol
to ensure the launch of a virtual machine (VM) instance on a trusted remote
compute host. Relying on Trusted Platform Module operations such as binding
and sealing to provide integrity guarantees for clients that require a trusted VM
launch, we have designed a trusted launch protocol for VM instances in public IaaS
environments. We also present a proof-of-concept implementation of the protocol
based on OpenStack, an open-source IaaS platform. The results provide a basis
for the use of TC mechanisms within IaaS platforms and pave the way for a wider
applicability of TC to IaaS security
Securely Launching Virtual Machines on Trustworthy Platforms in a Public Cloud
In this paper we consider the Infrastructure-as-a-Service (IaaS) cloud model which allows cloud users to run their own virtual machines (VMs) on available cloud computing resources. IaaS gives enterprises the possibility to outsource their process workloads with minimal effort and expense. However, one major problem with existing approaches of cloud leasing, is that the users can only get contractual guarantees regarding the integrity of the offered platforms. The fact that the IaaS user himself or herself cannot verify the provider promised cloud platform integrity, is a security risk which threatens to prevent the IaaS business in general. In this paper we address this issue and propose a novel secure VM launch protocol using Trusted Computing techniques. This protocol allows the cloud IaaS users to securely bind the VM to a trusted computer configuration such that the clear text VM only will run on a platform that has been booted into a trustworthy state. This capability builds user confidence and can serve as an important enabler for creating trust in public clouds. We evaluate the feasibility of our proposed protocol via a full scale system implementation and perform a system security analysis
Trusted Launch of Virtual Machine Instances in Public IaaS Environments
Cloud computing and Infrastructure-as-a-Service (IaaS) are emerging
and promising technologies, however their adoption is hampered by data security
concerns. At the same time, Trusted Computing (TC) is experiencing an increasing
interest as a security mechanism for IaaS. In this paper we present a protocol
to ensure the launch of a virtual machine (VM) instance on a trusted remote
compute host. Relying on Trusted Platform Module operations such as binding
and sealing to provide integrity guarantees for clients that require a trusted VM
launch, we have designed a trusted launch protocol for VM instances in public IaaS
environments. We also present a proof-of-concept implementation of the protocol
based on OpenStack, an open-source IaaS platform. The results provide a basis
for the use of TC mechanisms within IaaS platforms and pave the way for a wider
applicability of TC to IaaS security
Trusted Launch of Virtual Machine Instances in Public IaaS Environments
Cloud computing and Infrastructure-as-a-Service (IaaS) are emerging
and promising technologies, however their adoption is hampered by data security
concerns. At the same time, Trusted Computing (TC) is experiencing an increasing
interest as a security mechanism for IaaS. In this paper we present a protocol
to ensure the launch of a virtual machine (VM) instance on a trusted remote
compute host. Relying on Trusted Platform Module operations such as binding
and sealing to provide integrity guarantees for clients that require a trusted VM
launch, we have designed a trusted launch protocol for VM instances in public IaaS
environments. We also present a proof-of-concept implementation of the protocol
based on OpenStack, an open-source IaaS platform. The results provide a basis
for the use of TC mechanisms within IaaS platforms and pave the way for a wider
applicability of TC to IaaS security
Trusted Launch of Generic Virtual Machine Images in Public IaaS Environments
Cloud computing and Infrastructure-as-a-Service (IaaS) are emerging and promising technologies, however their faster-pased adoption is hampered by data security concerns. In the same time, Trusted Computing (TC) is experiencing a revived interest as a security mechanism for IaaS. We address the lack of an implementable mechanism to ensure the launch of a virtual machine (VM) instance on a trusted remote host. Relying on Trusted Platform Modules operations such as binding and sealing to provide integrity guarantees for clients that require a trusted VM launch, we have designed a trusted launch protocol for generic VM images in public IaaS environments. We also present a proof-of-concept implemen-
tation of the protocol based on OpenStack, an open-source IaaS platform. The results provide a basis for use of TC mechanisms within IaaS platforms and pave the way for a wider applicability of TC to IaaS security
Trusted Launch of Virtual Machine Instances in Public IaaS Environments
Cloud computing and Infrastructure-as-a-Service (IaaS) are emerging
and promising technologies, however their adoption is hampered by data security
concerns. At the same time, Trusted Computing (TC) is experiencing an increasing
interest as a security mechanism for IaaS. In this paper we present a protocol
to ensure the launch of a virtual machine (VM) instance on a trusted remote
compute host. Relying on Trusted Platform Module operations such as binding
and sealing to provide integrity guarantees for clients that require a trusted VM
launch, we have designed a trusted launch protocol for VM instances in public IaaS
environments. We also present a proof-of-concept implementation of the protocol
based on OpenStack, an open-source IaaS platform. The results provide a basis
for the use of TC mechanisms within IaaS platforms and pave the way for a wider
applicability of TC to IaaS security
Trusted Launch of Generic Virtual Machine Images in Public IaaS Environments
Cloud computing and Infrastructure-as-a-Service (IaaS) are emerging and promising technologies, however their faster-pased adoption is hampered by data security concerns. In the same time, Trusted Computing (TC) is experiencing a revived interest as a security mechanism for IaaS. We address the lack of an implementable mechanism to ensure the launch of a virtual machine (VM) instance on a trusted remote host. Relying on Trusted Platform Modules operations such as binding and sealing to provide integrity guarantees for clients that require a trusted VM launch, we have designed a trusted launch protocol for generic VM images in public IaaS environments. We also present a proof-of-concept implemen-
tation of the protocol based on OpenStack, an open-source IaaS platform. The results provide a basis for use of TC mechanisms within IaaS platforms and pave the way for a wider applicability of TC to IaaS security