Secure Virtual Machine Research Articles

Improving Responsiveness: Our Journey from Manual Yearly Updates to Automated Linkage for Near Real-Time Understanding of Outcomes and Modelling Future Service Demand

ObjectiveDemand for real-time data during the COVID-19 pandemic revealed a need to increase efficiencies in manual linkage processes to respond to events in near real-time. In response, our jurisdictional linkage agency transitioned from yearly to daily, weekly and monthly linkage practices through increasing automation and improving process flows. ApproachOur linkage agency transitioned to a fully automated process utilising scalable cloud infrastructure. Source data is now provided directly to a common data platform. This data is split into linkage and content, cleansed and quality assured in Python and set to automatically run via Azure data pipelines. The data is then linked via a combination of deterministic and probabilistic criteria, with data quality checks automatically performed along the way. Researchers can analyse this data in a secure virtual machine that only they can access and retrieve data from. Results This infrastructure expedites the data linkage process allowing daily linkage results to select datasets, and enables advanced research such as a predictive micro-simulation model, which leverages the platform to predict and intervene on outcomes influenced by governmental policies. This model relies on timely administrative data to build targeted interventions for groups with poor future outcomes, tests these interventions, and monitors outcomes in near real-time. ConclusionOur linkage agency has transitioned from manual to automated linkage processes in response to increasing need for timely data. By embracing cloud infrastructure and leveraging automation, we have streamlined our operations, enabling responsive linkage depending on need and expediting the provision of de-identified, linked data to researchers.

Elevating Security in Migration: An Enhanced Trusted Execution Environment-Based Generic Virtual Remote Attestation Scheme

Cloud computing, as the most widely applied and prominent domain of distributed systems, has brought numerous advantages to users, including high resource sharing efficiency, strong availability, and excellent scalability. However, the complexity of cloud computing environments also introduces various risks and challenges. In the current landscape with numerous cloud service providers and diverse hardware configurations in cloud environments, addressing challenges such as establishing trust chains, achieving general-purpose virtual remote attestation, and ensuring secure virtual machine migration becomes a crucial issue that traditional remote attestation architectures cannot adequately handle. Confronted with these issues in a heterogeneous multi-cloud environment, we present a targeted solution—a secure migration-enabled generic virtual remote attestation architecture based on improved TEE. We introduce a hardware trusted module to establish and bind with a Virtual Root of Trust (VRoT), addressing the challenge of trust chain establishment. Simultaneously, our architecture utilizes the VRoT within TEE to realize a general-purpose virtual remote attestation solution across heterogeneous hardware configurations. Furthermore, we design a controller deployed in the trusted domain to verify migration conditions, facilitate key exchange, and manage the migration process, ensuring the security and integrity of virtual machine migration. Lastly, we conduct rigorous experiments to measure the overhead and performance of our proposed remote attestation scheme and virtual machine secure migration process. The results unequivocally demonstrate that our architecture provides better generality and migration security with only marginal overhead compared to other traditional remote attestation solutions.

Secure Multiparty Computation Using Secure Virtual Machines

The development of new processor capabilities which enable hardware-based memory encryption, capable of isolating and encrypting application code and data in memory, have led to the rise of confidential computing techniques that protect data when processed on untrusted computing resources (e.g., cloud). Before confidential computing technologies, applications that needed data-in-use protection, like outsourced or secure multiparty computation, used purely cryptographic techniques, which had a large negative impact on the processing performance. Processing data in trusted enclaves protected by confidential computing technologies promises to protect data-in-use while possessing a negligible performance penalty. In this paper, we have analyzed the state-of-the-art in the field of confidential computing and present a Confidential Computing System for Artificial Intelligence (CoCoS.ai), a system for secure multiparty computation, which uses virtual machine-based trusted execution environments (in this case, AMD Secure Encrypted Virtualization (SEV)). The security of the proposed solution, as well as its performance, have been formally analyzed and measured. The paper reveals many gaps not reported previously that still exist in the current confidential computing solutions for the secure multiparty computation use case, especially in the processes of creating new secure virtual machines and their attestation, which are tailored for single-user use cases.

SDN enabled role based shared secret scheme for virtual machine security in cloud environment

Cloud computing has given a new direction towards the usage of resources based on the demand without depending on the location. Even though there are many advantages with cloud computing there are challenges and security being one among them. Especially at Infrastructure as a Service (IaaS) level, where the actual resources are shared, security has given more importance. Robust access control mechanisms are to be applied to safeguard the cloud environment. In this paper, Software Defined Network (SDN) enabled role-based access control along with trust-based model is proposed. This model considers the roles of the users and provides the finely grained access to the virtual machines in the cloud. Secret shares are shared fairly among the users based on two parameters namely trust and roles assigned to the participants. Secret has to be reconstructed to access the Virtual Machine (VM) and to reconstruct, the secret shares are taken from different trusted users at different levels. Cloud service provider will be unaware of the secret shares which are distributed among the participant users. SDN Controller is responsible for taking care of share generation, distribution of shares among the user participants and reconstruction of secret. In order to avoid malicious user participants, trust evaluator periodically checks the trust value. The security analysis prove that scheme is more secure and efficient in comparison with other approaches.

Secure Virtual Machine Live Migration using Advanced Metric Encryption

Abstract: Cloud is based on the underlying technology of virtualization. Here, the physical servers are divided into multiple virtual servers. Through the technology of virtualization, each virtual server contains virtual machines. Live virtual machine migration is expected to be with the aim of having migration time and inactive time with minimal duration. Various machine-learning approaches have been investigated and identified research gaps to enhance the security features during the migration process. Moreover, a secure virtual machine live migration is proposed using Advanced Metric Encryption (AME). Considering the duration of live migration in data centers as well as ensuring the security aspects, the proposed model has been tested and evaluated.

Machine Learning Algorithms for Intrusion Detection in Cybersecurity

Abstract: Computer networks and virtual machine security are very necessary in today’s time. An Intrusion Detection System (IDS) is a security mechanism designed to monitor computer networks or systems for malicious activities or unauthorized access attempts. The primary function of an IDS is to detect and respond to potential security breaches in real time. Tasks performed by an IDS are anomaly detection, Signature detection, security alert generation, etc… Various researchers are actively working on different ideas for increasing the performance of the IDS. We have used a machine-learning approach for intrusion detection. We have used SVM, Random Forests, and Decision trees for detecting intrusions.

A Machine Learning Approach for Intrusion Detection

Abstract: Computer networks and virtual machine security are very essential in today’s era. IDS monitors a network or system for malicious action and protects a computer network from unofficial access from users, including perhaps insiders. Various existing systems have already been developed to detect malicious activity on target machines; sometimes any external user creates some malicious behavior and gets unauthorized access to victim machines to such a behavior system considered as malicious activities or Intruder. Machine Learning (ML) algorithms are applied in IDS in order to identify and classify security threats. Numerous machine learning and soft computing techniques are designed to detect the activities in real-time network log audit data. KKDDCUP99 and NLSKDD most utilized data sets to detect the Intruder on the benchmark data set. In this paper, we proposed the identification of impostors using machine learning algorithms. Two different techniques have been proposed a signature with detection and anomaly-based detection. The experimental analysis demonstrates SVM, Naïve Bayes, and ANN algorithms with various data sets and demonstrates system performance in the real-time network environment.

Energy efficient cloud computing using secure virtual machine migration: A taxonomy

Numerous cloud service enterprises have launched a broad variety of cloud services. Several businesses and people use these programs on a daily basis. The efficiency of cloud service depends on efficiency of the service providers. It is also important for cloud customers to analyses and review the available cloud resources thoroughly to pick the best cloud service. Secure virtual machine placement is a big issue during the migration of virtual machines in cloud computing. Secure virtual machine migration maximizes the throughput and reliability of the system and reduces Service Level Agreement (SLA) violations. This article focuses on secure virtual machine migration with energy-efficient techniques

OSVR: an efficient support vector regression model based host overload detection and secure virtual machine migration

OSVR: an efficient support vector regression model based host overload detection and secure virtual machine migration

Secure Virtual Machine Image Storage Process into a Trusted Zone-based Cloud Storage

The emerging trend of Cloud Computing inducts virtualization as the quintessence concept to offer to end users a large scale Infrastructure-as-a-Service (IaaS) paradigm. Virtualization leverages virtual environment instantiated from user namely Virtual Machine Images (VMI) where user has the ability to provision and manage its own operating system. Therefore, user VMI dynamic data privacy depends upon the supplied security policy by Cloud Service Provider (CSP) and cloud storage architecture which remains the most prominent cloud delivered services. This paper covers thoroughly a secure storage process of user VMI in a cloud zone-based storage based on Proof-of-Retrievability (PoR). The proposed security architecture ensures the elementary security triad CIA (Confidentiality, Integritty and availability). VMI data confidentiality comprises generation of encryption key pair based on Goppa Code and McEliece cryptosystem, thus, integrity and stored VMI dynamic data correctness have been ensured using public auditing privacy-preserving in cloud zone-based storage. a know practical Error-Correcting-Codes (ECC) in heuristic researches

A sampling-based online Co-Location-Resistant Virtual Machine placement strategy

In this paper, we discuss the co-location attack problem in the cloud IaaS from the Virtual Machine (VM) placement strategy perspective. We formulate the online secure optimization VM placement problem in a way that guarantees—apriori—a specified level of security while minimizing the number of used physical servers. To solve such a problem, we propose an approximate online secure VM placement algorithm based on sampling. The polynomial-time algorithm is based on a sound security inference procedure based on the confidence interval estimation method. Our empirical results demonstrate the correctness and the effectiveness of our approach in guaranteeing a Co-Location-Resistant (CLR) VM placement with a specific level of confidence and a threshold error as new incoming VM requests are being assigned to servers online. We compared our algorithm to a CLR alternative presented in Azar et al. (2014).

Defending Against Co-Residence Attack in Energy-Efficient Cloud: An Optimization Based Real-Time Secure VM Allocation Strategy

Resource sharing among users serves as the foundation of cloud computing, which, however, may also cause vulnerabilities to diverse co-residence attacks launched by malicious virtual machines (VM) residing in the same physical server with the victim VMs. In this paper, we aim to defend against such co-residence attacks through a secure, workload-balanced, and energy-efficient VM allocation strategy. Specifically, we model the problem as an optimization problem by quantifying and minimizing three key factors: (1) the security risks, (2) the power consumption and (3) the unbalanced workloads among different physical servers. Furthermore, this work considers a realistic environmental setting by assuming a random number of VMs from different users arriving at random timings, which requires the optimization solution to be continuously evolving. As the optimization problem is NP-hard, we propose to first cluster VMs in time windows, and further adopt the Ant Colony Optimization (ACO) algorithm to identify the optimal allocation strategy for each time window. Comprehensive experimental results based on real world cloud traces validates the effectiveness of the proposed scheme.

BlockchainBus: A lightweight framework for secure virtual machine migration in cloud federations using blockchain

AbstractCloud federations offer numerous advantages such as improved resilience, improved performance, and the prevention of vendor lock‐in. In order to function efficiently, however, they must be supported by automated solutions to deploy cloud resources securely and efficiently. In particular, a system which allows virtual machine (VM) migration from one cloud to another while recording this for charging and security purposes is particularly useful. This paper presents a lightweight framework called BlockchainBus which offers secure VM migration in cloud federations using blockchain. This framework is a VM migration Blockchain ledger which can be used to record these migrations. BlockchainBus framework is implemented using the HyperLedger solution and deployed on the Microsoft Azure cloud platform. The overhead of this system is then evaluated. The performance of the BlockchainBus framework was compared with the overall VM migration time and was determined as 2.36 seconds. This result is shorter than the overall VM migration time of 5 seconds and indicates that the BlockchainBus gives better performance.

Representing Increasing Virtual Machine Security Strategy in Cloud Computing Computations

This paper proposes algorithm for Increasing Virtual Machine Security Strategy in Cloud Computing computations. Imbalance between load and energy has been one of the disadvantages of old methods in providing server and hosting, so that if two virtual severs be active on a host and energy load be more on a host, it would allocated the energy of other hosts (virtual host) to itself to stay steady and this option usually leads to hardware overflow errors and users dissatisfaction. This problem has been removed in methods based on cloud processing but not perfectly, therefore,providing an algorithm not only will implement a suitable security background but also it will suitably divide energy consumption and load balancing among virtual severs. The proposed algorithm is compared with several previously proposed Security Strategy including SC-PSSF, PSSF and DEEAC. Comparisons show that the proposed method offers high performance computing, efficiency and consumes lower energy in the network.

A review paper on hypervisor and virtual machine security

A hypervisor is a computer programme or software that facilitates to create and run multiple virtual machines. It is also known as Virtual Machine Manager (VMM). Due to their popularity, it exploits the attack surface, because the Hypervisor code contains much vulnerability. Since the Hypervisor is a core element of any cloud computing service, it is always on the top priority of the attackers. There are many Software (open source) and Hardware-based Solutions are available in the market to monitor and control the hypervisor activities. This paper summarizes various types of attacks, vulnerabilities, security issues and challenges related to hypervisor and virtual machines.

The impact of long-term workers' compensation benefit cessation on welfare and health service use: protocol for a longitudinal controlled data linkage study.

BackgroundIn 2012, the Australian state of New South Wales passed legislation that reformed its workers’ compensation system. Section 39 introduced a five-year limit on income replacement, with the first affected group having their benefits cease in December 2017. There is limited evidence on how this will affect their healthcare service use and where they will go for financial support.MethodsMultiple data sources will be linked: administrate workers’ compensation claims data from the State Insurance Regulatory Authority (SIRA), universal health insurance data from the Medical Benefits Schedule (MBS) and Pharmaceutical Benefits Scheme (PBS), state hospital and emergency department data, and social welfare data from the Department of Social Services’ Data Over Multiple Individual Occurrences (DOMINO). An estimated 4,125 injured workers had their benefits cease due to Section 39. These will form the exposure group who will be compared to 1) a similar group of workers’ compensation claimants who have had at least two years of compensated time off work but whose benefits did not cease due to Section 39; and 2) a community comparison group drawn from state hospital and emergency department records.An accredited third party will link the data, which will be accessible only via secure virtual machine. Initial analyses will compare the prevalence and incidence of service use across groups in both the year before and year after benefit cessation; the community control will be assigned the median benefit cessation date in lieu of an actual date. To estimate the impact of benefit cessation due to Section 39, we will conduct time series analysis of the prevalence and incidence of service use.DiscussionThis study will provide much-needed evidence on the consequences of long-term benefit cessation, particularly on subsequent healthcare and welfare service use.

A Novel Framework for Cloud based Virtual Machine Security by Change Management using Machine

A Novel Framework for Cloud based Virtual Machine Security by Change Management using Machine

Optimal Security-Aware Virtual Machine Management for Mobile Edge Computing Over 5G Networks

A secure execution of offloaded tasks in the 5G-driven mobile edge computing (MEC) deployment is critical for all societal sectors. To realize it, mobile network operators have to intelligently orchestrate virtual resources in multiple cloud layers to satisfy 5G security requirements. In this article, we formulate a secure virtual machine management (VMM) mechanism using the semi-Markov decision process framework that seeks to jointly minimize the service rejection and the security risk, while meeting the location awareness requirements of latency-sensitive applications in a decentralized fashion. A new metric called mean security risk is proposed to quantify the perceived risk of an offloaded application considering the number of virtual machines (VMs) that is used to execute and to protect it. We also propose a new cost structure that allows for an efficient assessment of the long-term impact of providing additional VMs to foster security services. A comparison with an optimal security-unaware VMM mechanism shows that our model provides a less risky operation at the cost of an increase in service rejection, which is caused by the use of additional VMs to shield the computation task. Finally, we show that the cost of providing security services can be significantly reduced by fine-tuning the economic gains of it.

Security and trust preserving inter‐ and intra‐cloud VM migrations

SummaryThis paper focus on providing a secure and trustworthy solution for virtual machine (VM) migration within an existing cloud provider domain, and/or to the other federating cloud providers. The infrastructure‐as‐a‐service (IaaS) cloud service model is mainly addressed to extend and complement the previous Trusted Computing techniques for secure VM launch and VM migration case. The VM migration solution proposed in this paper uses a Trust_Token based to guarantee that the user VMs can only be migrated and hosted on a trustworthy and/or compliant cloud platforms. The possibility to also check the compliance of the cloud platforms with the pre‐defined baseline configurations makes our solution compatible with an existing widely accepted standards‐based, security‐focused cloud frameworks like FedRAMP. Our proposed solution can be used for both inter‐ and intra‐cloud VM migrations. Different from previous schemes, our solution is not dependent on an active (on‐line) trusted third party; that is, the trusted third party only performs the platform certification and is not involved in the actual VM migration process. We use the Tamarin solver to realize a formal security analysis of the proposed migration protocol and show that our protocol is safe under the Dolev‐Yao intruder model. Finally, we show how our proposed mechanisms fulfill major security and trust requirements for secure VM migration in cloud environments.

Secure VM management with strong user binding in semi-trusted clouds

In Infrastructure-as-a-Service (IaaS) clouds, remote users access provided virtual machines (VMs) via the management server. The management server is managed by cloud operators, but not all the cloud operators are trusted in semi-trusted clouds. They can execute arbitrary management commands to users’ VMs and redirect users’ commands to malicious VMs. We call the latter attack the VM redirection attack. The root cause is that the binding of remote users to their VMs is weak. In other words, it is difficult to enforce the execution of only users’ management commands to their VMs. In this paper, we propose UVBond for strongly binding users to their VMs to address this issue. UVBond boots user’s VM by decrypting its encrypted disk inside the trusted hypervisor. Then it issues a VM descriptor to securely identify that VM. To bridge the semantic gap between high-level management commands and low-level hypercalls, UVBond uses hypercall automata, which accept the sequences of hypercalls issued by commands. We have implemented UVBond in Xen and created hypercall automata for various management commands. Using UVBond, we confirmed that a VM descriptor and hypercall automata prevented insider attacks and that the overhead was not large in remote VM management.