Virtualization-based Approach Research Articles

CAFE: A Virtualization-Based Approach to Protecting Sensitive Cloud Application Logic Confidentiality

Cloud application marketplaces of modern cloud infrastructures offer a new software deployment model, integrated with the cloud environment in its configuration and policies. However, similar to traditional software distribution which has been suffering from software piracy and reverse engineering, cloud marketplaces face the same challenges that can deter the success of the evolving ecosystem of cloud software. We present a novel system named CAFE for cloud infrastructures where sensitive software logic can be executed with high secrecy protected from any piracy or reverse engineering attempts in a virtual machine even when its operating system kernel is compromised. The key mechanism is the end-to-end framework for the execution of applications, which consists of the secure encryption and distribution of confidential application binary files, and the runtime techniques to load, decrypt, and protect the program logic by isolating them from tenant virtual machines based on hypervisor-level techniques. We evaluate applications in several software categories which are commonly offered in cloud marketplaces showing that strong confidential execution can be provided with only marginal changes (around 100-220 lines of code) and minimal performance overhead. The results demonstrate the effectiveness and practicality of CAFE in cloud marketplaces.

Enhancing Rescue Operations With Virtualized Mobile Multimedia Services in Scarce Resource Devices

The aim of this article is to present an architecture to support reconfigurable multimedia services for a practical emergency environment use case of rescue operations. Specifically, radio communication and video surveillance services are provided by means of a small device carried by a mobile vehicle. This solution is validated by implementing a digital mobile radio (DMR) standard radio hotspot and a video streaming server in an unmanned aerial vehicle (UAV) that conveys a device with scarce resources in order to minimize power consumption. To achieve a fast and flexible deployment of the envisioned services, a virtualization-based approach is proposed. Namely, a Kubernetes orchestrator is used to manage the life-cycle of services deployed on a small resource device, endowing the architecture with scalability and management flexibility. This article describes the executed performance tests that measured key parameters such as deployment time and recovery time after disconnection. Highly promising results were obtained, showing that the proposed architecture can be deployed in less than 4 minutes and can recover from network disconnections in less than 10 seconds. Thus, the performance, reliability and flexibility of the overall solution are demonstrated.

A Virtualization-Based Approach for Application Whitelisting

A Virtualization-Based Approach for Application Whitelisting

Using virtualization to protect application address space inside untrusted environment

The paper describes a virtualization-based approach to protecting context of trusted processes running inside potentially compromised environment. Suggested protection system is based on a hypervisor that monitors all events inside operating system and prevents unauthorized access to process resources. The approach does not require modification of OS or applications; the only requirement for hardware is support for virtualization.

A Virtualization-based Approach to Dependable Service Computing

Dependability represents a critical requirement for modern distributed systems. Today new requirements emerged. Among them reliability, safety, availability, security and maintainability are needed by more and more modern distributed service computing architectures. In this paper we present an approach to ensuring dependability in distributed infrastructures using virtualization for fault-tolerance, augmented with advanced security models. The proposed solution is part of a hierarchical architectural model that allows a unitary and aggregate approach to dependability requirements while preserving scalability of large scale distributed systems. In this context we propose dependability solutions based on the use of virtualization and modern security models, combined together to automatically protect services and applications belonging to the distributed system. We also present evaluation results for several scenarios, involving applications and services with different characteristics.