1. Virtual machines image protection in Cloud computing
Muhammad Kazim (2011-NUST-MSCCS-23)
Thesis Supervisor
Dr. Muhammad Awais Shibli
G.E.C Members
Dr. Abdul Ghafoor Abbasi
Dr. Hamid Mukhtar
Ms. Rahat Masood
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

2. Agenda Introduction Motivation Research Methodology Problem Statement
Research Contributions
Implementation
Results
Evaluation
Conclusion
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

3. Virtualization
In Cloud computing, Virtualization is the basis of providing Infrastructure as a Service (IaaS).
A single system can concurrently run multiple isolated virtual machines (VMs), operating systems or multiple instances of a single operating system (OS).
Virtualization maximizes the jobs a single CPU can do.
Organizations are using virtualization to gain efficiency in platform and application hosting.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST – Islamabad

4. Virtualization in Cloud
Figure 1: Virtualization in Cloud
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

5. Virtual Disk Image
A single file or directory representing the hard drive of a guest operating system.
Encapsulates all components of a guest OS, including the applications and virtual resources used by guest OS.
Provides the ability to quickly launch and deploy virtual machines across various hosts.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

6. Motivation
According to different surveys , virtualization security is one of the most important security issues in Cloud.
Disk images in storage can be compromised through attacks such as unauthorized access, data leakage, malware installation and snapshot access in storage.
Through attacks integrity, and confidentiality of images and sensitive customer data stored in them can be compromised.
Standard bodies (NIST, CSA and PCI DSS) have published security guidelines to emphasize the importance of virtualization and disk images security.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

7. Research Methodology Identifying problem statement
Defining research area
Develop hypothesis
Literature review
Framework
implementation
Testing and evaluation
Design framework
Figure 2: Thesis research methodology
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

8. Related Work Literature survey Virtual machines security
IaaS Security
Security analysis of virtualization
Virtual machines security
Disk images security
Security guidelines on virtualization
National Institute of Standards and Technology (NIST)
Cloud Security Alliance (CSA)
Payment Card Industry Data Security Standard (PCI DSS)
Industrial solutions
Storage Made Easy, Piston Cloud and Metacloud
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

9. Problem Statement
Virtual machine images are vulnerable to infrastructure, hypervisor and storage attacks in Cloud. Therefore, VM images must be secured in Cloud storage through best security practices, both for protecting the sensitive customer data and maintaining the integrity of disk images.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

10. Research Contributions
Theoretical (Two research publications)
Practical (Development of disk image protection framework)
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

11. Conference Papers
Muhammad Kazim, Rahat Masood, Muhammad Awais Shibli, Abdul Ghafoor Abbasi, “Security aspects of virtualization in Cloud computing”, 12th International Conference on Computer Information Systems and Industrial Management Applications, CISIM, Springer, Krakow-Poland 2013, September
Muhammad Kazim, Rahat Masood, Muhammad Awais Shibli, “Securing the virtual machine images in Cloud computing”, 6th International Conference on Security of Information and Networks (SIN 2013), ACM-SIGSAC, Aksaray-Turkey 2013, November
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

12. Analysis of virtualization security in Cloud
The security analysis of Cloud virtualization was done from three different aspects including:
General requirements for securing Cloud virtualization components including hypervisor, virtual machines, disk images and service providers.
Identification of possible attacks on virtualization components.
Analysis of existing techniques for the security of virtualization components.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

13. Virtual machines security analysis
Requirements
Attacks
Solutions
Isolation between virtual machines should be properly implemented
Malicious programs use covert channels to communicate with other VMs in unauthorized way
Vigilant can monitor faults in guest OS of VM
Update the OS regularly and use anti-virus software, secure internet and restrict remote access
Malicious programs can monitor traffic, steal critical data, and tampering the functionality of VMs
Security features such as firewall, HIPS, log monitoring must be provided in guest OS
Securely boot the guest VMs
Attacker can tamper boot process of guest VMs
Security protocol by J. Kong can be to ensure secure boot of guest VMs
There must be limit on VMs resource usage
Using a malicious VM to consume extra resources of the system, resulting in DOS attack
Administrator must deploy a software or application that limits VMs to use authorized resources
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

14. Disk images security analysis
Requirements
Attacks
Solutions
Disk images must be secured from storage attacks
Attacker can compromise the stored images by installing malware and accessing the contents of images
Use encryption and hashing of images before saving them
Snapshot access must be prevented from authorized access
VM checkpoint attacks
Checkpoint attacks can be prevented by encrypting the checkpoints using SPARC
Apply updates and patches to maintain images secure
Old images are vulnerable to zero day attacks
Nuwa is a tool designed to apply efficient patching to VM images in Cloud
Backup of the virtual machines images must be
maintained
Unauthorized access to the backup data can result in leakage of sensitive
information
Backup of VM images must be encrypted. J. Wei et.al. proposed an image management system to manage Cloud VM images
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

15. Implementation Perspective
Implement a framework that that ensures confidentiality of images through encryption.
Images are decrypted when required by the VM.
Hashing techniques are used to ensure integrity of images.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

16. Encrypted Virtual Disk Images in Cloud (EVDIC)
To secure the virtual machine images from storage attacks in Cloud, EVDIC is proposed.
EVDIC protects the virtual machine images in Cloud by encrypting them before storage. The images are decrypted only when required by the virtual machine.
EVDIC proposes the security of key management and key exchange process.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

17. Disk Image Storage in Cloud
Figure 4: Image Encryption in Cloud
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

18. Disk Image Retrieval in Cloud
Figure 5: Image Decryption in Cloud
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

19. OpenStack
OpenStack is a highly scalable and elastic cloud computing platform for both large and small public private Clouds.
There are currently seven core components of OpenStack: Compute, Object Storage, Identity, Dashboard, Block Storage, Network and Image Service.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

20. Deployment of OpenStack for development
Devstack
A documented shell script to build complete OpenStack development environments
Deployment of Devstack
Setup a fresh supported Linux installation
Clone devstack
Deploy your OpenStack Cloud
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

21. Debugging of source code
Debugging of Swift through command line
Pdb (Python debugger)
Figure 6: Command line debugging using pdb
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

22. Virtual machines in OpenStack
Figure 7: Virtual machines cycle in OpenStack
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

23. Integration of Image encryption and decryption with Swift
OpenStack Swift API is implemented as a set of ReSTful web services.
The proxy server initiates an internal Swift PUT request to the object servers.
Object servers processes images chunk by chunk so each chunk gets encrypted and gets stored as part of encrypted file.
For decryption object server decrypts each chunk before it sends the image to the proxy server.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

24. Image Encryption Module in Swift
Figure 8: Image Encryption in OpenStack
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

25. Image Decryption Module in Swift
Figure 9: Image Decryption in OpenStack
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

26. Virtual machines cycle in OpenStack
IEM & IDM
Figure 10: IEM and IDM in OpenStack
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

27. Results
After VM termination, image is stored into Swift encrypted storage.
AES is block sized encryption, that adds extra padding to images.
Encryption of images maintains their confidentiality in Cloud storage.
Hash of image is taken before encryption. During decryption hash of image is calculated again, and compared with the original hash to ensure integrity of image.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

28. Evaluation
Various tools can be used to explore and modify the images including CDmage, Daemon tools and Archive Manager.
The content of encrypted images cannot be displayed by these tools.
Our system provides protection to images from data leakage, data alteration and image modification.
Performance evaluation of the system shows ~15% overhead caused on image processing time due to increase of image size after encryption, retrieval of encryption keys during encryption, decryption and applying the cryptographic techniques.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

29. Evaluation Figure 11: Image upload in Swift
Figure 12: Image download in Swift
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

30. Conclusion
Image encryption module encrypts all virtual disk images before storage in OpenStack. They are decrypted when required by the virtual machine.
Integrity and confidentiality of virtual machine images in storage is ensured. They are secure from all possible storage attacks such as data theft, malware installation and hypervisor issues.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

31. Future Directions
Encryption of accounts to protect users and images lists in Swift.
Integration of Key Management protocol with Swift image encryption.
Encryption of persistent storage used by virtual machines during execution.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

32. References
[1] Shubhashis Sengupta, Vikrant Kaulgud, Vibhu Saujanya Sharma, “Cloud Computing Security - Trends and Research Directions”, IEEE World Congress on Services, Washington, DC, USA, [2] Jakub Szefer, Ruby B. Lee, “A Case for Hardware Protection of Guest VMs from Compromised Hypervisors in Cloud Computing”, 31st International Conference on Distributed Computing Systems Workshops, Washington, DC, USA, [3] Jinzhu Kong, “Protecting the confidentiality of virtual machines against untrusted host”, International Symposium on Intelligence Information Processing and Trusted Computing, Washington, DC, USA, [4] Farzad Sabahi, “Secure Virtualization for Cloud Environment Using Hypervisor-based Technology”, International Journal of Machine Learning and Computing vol. 2, no. 1, February 2012, pp [5] Jenni Susan Reuben, “A Survey on Virtual Machine Security”, TKK T Seminar on Network Security, 2007.
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

33. [6] Seongwook Jin, Jeongseob Ahn, Sanghoon Cha, and Jaehyuk Huh, “Architectural Support for Secure Virtualization under a Vulnerable Hypervisor”, Proceedings of the 44th Annual IEEE/ACM International Symposium on Microarchitecture, USA, [7] Ryan Shea, Jiangchuan Liu, “Understanding the Impact of Denial of Service on Virtual Machines”, IEEE 20th International Workshop on Quality of Service (IWQoS), Burnaby, BC, Canada, [8] Wu Zhou, Peng Ning, Xiaolan Zhang, “Always up-to-date: scalable offline patching of VM images in a compute cloud”, Proceedings of the 26th Annual Computer Security Applications Conference, New York, USA, 2010, pp [9] J.Wei, X. Zhang, G. Ammons, V. Bala, and P. Ning, “Managing security of virtual machine images in a cloud environment," in Proceedings of the 2009 ACM workshop on Cloud computing security. ACM, 2009, pp [10] Mikhail I. Gofman, Ruiqi Luo, Ping Yang, Kartik Gopalan, “SPARC: A security and privacy aware Virtual Machine checkpointing mechanism”, Proceedings of the 10th annual ACM workshop on Privacy in the electronic society, New York, USA, 2011, pp
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad

34. THANKYOU
THANKYOU
Department of Computing, School of Electrical Engineering and Computer Sciences, NUST - Islamabad