Virtual Security Research Articles

From virtualization security issues to cloud protection opportunities: An in-depth analysis of system virtualization models

Virtualization methods and techniques play an important role in the development of cloud infrastructures and their services. They enable the decoupling of virtualized resources from the underlying hardware, and facilitate their sharing amongst multiple users. They contribute to the building of elaborated cloud services that are based on the instantiation and composition of these resources. Different models may support such a virtualization, including virtualization based on type-I and type-II hypervisors, OS-level virtualization, and unikernel virtualization. These virtualization models pose a large variety of security issues, but also offer new opportunities for the protection of cloud services. In this article, we describe and compare these virtualization models, in order to establish a reference architecture of cloud infrastructure. We then analyze the security issues related to these models from the reference architecture, by considering related vulnerabilities and attacks. Finally, we point out different recommendations with respect to the exploitation of these models for supporting cloud protection.

VISE: Combining Intel SGX and Homomorphic Encryption for Cloud Industrial Control Systems

Protecting data-in-use from privileged attackers is challenging. New CPU extensions (notably: Intel SGX) and cryptographic techniques (specifically: Homomorphic Encryption) can guarantee privacy even in untrusted third-party systems. HE allows sensitive processing on ciphered data. However, it is affected by i) a dramatic ciphertext expansion making HE unusable when bandwidth is narrow, ii) unverifiable conditional variables requiring off-premises support. Intel SGX allows sensitive processing in a secure enclave. Unfortunately, it is i) strictly bonded to the hosting server making SGX unusable when the live migration of cloud VMs/Containers is desirable, ii) limited in terms of usable memory, which is in contrast with resource-consuming data processing. In this article, we propose the VIrtual Secure Enclave (VISE), an approach that effectively combines the two aforementioned techniques, to overcome their limitations and ultimately make them usable in a typical cloud setup. VISE moves the execution of sensitive HE primitives (e.g., encryption) to the cloud in a remotely attested SGX enclave, and then performs sensitive processing on HE data-outside the enclave-leveraging all the memory resources available. We demonstrate that VISE meets the challenging security and performance requirements of a substantial application in the Industrial Control Systems domain. Our experiments prove the practicability of the proposed solution.

S-Blocks: Lightweight and Trusted Virtual Security Function With SGX

Despite the advantages of scalability and flexibility, Security Function Virtualization (SFV) raises concerns about its own security. To enhance the security of SFV, a promising approach is to run critical components of off-the-shelf security software inside SGX enclaves. This idea, however, is hardly practical due to the difficulty of detaching components from the monolithic security function and the unacceptable cost of running them in enclaves. In this work, we propose S-Blocks, an architecture to modularize a virtual security function (VSF) and protect its key modules with SGX in an efficient manner. Through systematically decomposing modules of a VSF into related elements, it is easy to put the key modules and elements of the VSF into an enclave. Furthermore, aiming at addressing state consistency and secure migration issues of security function scaling, we design a fine-grained state synchronization and migration mechanism to ensure lose-free, order-preserving, and state security for VSFs. To demonstrate the effectiveness of our approach, we prototype S-Blocks using Fast-Click on a real Skylake platform and implement three main types of virtual security functions based on the S-Blocks architecture. Our evaluation results show that S-Blocks only imposes a manageable performance overhead, and low latency and resource consumption when protecting VSFs.

Detailed Review of Different Security Techniques for Data Protection in Cloud Computing

Now, a day’s Data protection in cloud has become a vital and tremendously increasing technology. Many international organizations are listening in cloud computing and its wonderful features but they're troubled about the protection, privacy, and availability of data because it rests in the cloud. Cloud computing contains plenty of security issues that are in advance great attention nowadays, as well as the information shield, network security, virtualization security, application integrity, and identity management. Data protection is one among the foremost important security issues, because organizations won’t relocate its data to remote machines if there isn't any guaranteed data protection from the cloud service providers. A lot of techniques are recommending for data protection in cloud computing, but there are still plenty of challenges during this subject. The leading popular security techniques contain SSL (Secure Socket Layer) Encryption, Intrusion Detection System; Multi contract based Access Control, etc. also, security techniques for data protection are visiting recommending so on acquire improved security in cloud computing.

Research on Virtualization Security in Cloud Computing

Cloud computing services, with its advantages of flexible configuration, efficient utilization of resources and easy management, have achieved rapid development and wide application, in recent years. However, the security issues in cloud computing are also becoming increasingly prominent, at same time, cloud computing security has become an important factor hindering the development of cloud computing. The virtualization technology is one of the core technologies of cloud computing, meanwhile, virtualization security is the core issue of cloud computing security as well. This article introduces the mainstream virtualization technology, reviews the security threats of virtualization in cloud computing, and puts forward the corresponding countermeasures.

Impact of cloud computing on network management

Cloud computing solution is now being adopted for reasons of economic and technical benefits by organizations to deliver array of services over the internet. Service provisioning has increased, so has the subscribers that access these services, as well as increased complexity in cloud infrastructures. However, cloud benefits to providers and clients may erode if there are no adequate cloud managing/monitoring frameworks built on the peculiar characteristics of the mission-critical environment. Plethora of literatures have been written on cloud architecture, implementation, services, virtual machines, energy efficiency, security, privacy, data loss etc. but not much on how cloud has changed our perception of network management with respect to five functional areas: Fault Configuration, Application, Performance and Security (FCAPS) of International Standard Organization (ISO). Noting that not much work has been done in this direction, this paper presents detailed analysis of the cloud, cloud network management with emphasis to the ISO functional areas. It uses key cloud-centric issues of concern to discuss and critically analyse the impact of cloud computing to network management and proffer significant ways forward within the possible capabilities of existing technology.Keywords Cloud-based virtual network (CVN), Cloud computing, Data Centre, Fault Configuration, Application, Performance and Security (FCAPS), Virtual Machine (VM)Vol. 26, No. 1, June 2019

Bayesian attack graphs for platform virtualized infrastructures in clouds

Virtualization security is an important aspect to be carefully addressed while provisioning cloud services. In this paper, we propose a novel model using Bayesian Attack Graphs (BAG) to perform security risk assessment for platform virtualized infrastructures that are used for building cloud services. BAGs are powerful mechanisms that can be used to model the uncertainties inherent in security attacks. We build upon the reference conditional probability tables for the BAG nodes using the reported attacks on virtualized systems from the Common Vulnerabilities and Exposures (CVE) database. We employ Bayesian probabilistic inference techniques on the model presented and showcase the results obtained that can be used by system architects for the risk assessment of such infrastructures. In addition to the probabilistic model, we also present a deterministic approach with security metrics for attack graphs and derive the values for the modeled BAG, which can be used for assessing and comparing with other architectures. The approach described here to draw inferences from the BAG can be employed by system architects to find explanations to critical queries in security design and also to carefully select the countermeasures to be installed. The model can also be used to learn from future a-posteriori evidence data from actual security breaches to provide an efficient risk assessment.

Virtualization and Cloud Security: A Review

Virtualization and Cloud Security: A Review

SDN/NFV-Based Security Service Function Tree for Cloud

Network security for cloud computing is very important. Service function chain (SFC) that integrates software defined network (SDN) and network function virtualization (NFV) can provide a new approach for solving the network security issues for cloud computing. In this paper, we combine multiple SFCs into a security service function tree (or SecSFT, for short) to reduce requirement for resources in allocating virtual security functions. According to the idea of decision tree used for classification, we assign decision rules and detection rules to the nodes of the SecSFT so that they can identify and split suspicious flows from the mixed traffic and detect/prevent intrusions in the suspicious ones. The nodes of the SecSFT implement various virtualized functions including security-related network functions (e.g., load balancing, and traffic shaping), network security functions (e.g., intrusion detection, firewall), and virtualized network security hardware. Finally, we build a SecSFT in an experiment cloud and test and validate its security services in detection and mitigation of network attacks.

Safety Protection Design of Virtual Machine Drift Flow in Cloud Data Center Based on VXLAN Technology

Based on the analysis of the security problems existing in the cloud platform of the data center, this paper proposes a set of cloud platform security protection scheme being with virtualization technology. This paper focuses on the overall architecture of cloud platform as well as the design of virtualization security architecture. Meantime, it introduces the key technologies of VXLAN in detail. The scheme realizes flexible scheduling of security resources through virtual pooling of independent security gateway and virtual machine isolation through VXLAN technology. Moreover, it guides all horizontal traffic to independent security gateway for processing, unified management of security gateway through cloud platform by using Huawei NSH business chain technology. This scheme effectively solves the horizontal transmission of security threat among virtual machines, and realizes the fine security control and protection for the campus data center.

Dynamic Control Method for Tenants’ Sensitive Information Flow Based on Virtual Boundary Recognition

In the cloud environment, owing to the large-scale sharing of the upper application instance and the underlying virtual machine resources, the tenants' information flow boundary in the shared virtual machine is fuzzy and difficult to identify. In addition, protection of tenant information flow between processes is inadequate, resulting in the leakage of sensitive information of tenants. Therefore, a dynamic control method for tenants' sensitive information flow based on virtual boundary recognition is proposed. By analyzing the behavior and operation log of tenants, the behavior feature vectors of tenants are constructed, and an automatic recognition algorithm of tenant virtual boundary based on the dynamic spiking neural network is designed. This algorithm can realize dynamic identification of the tenant virtual security boundary when the application service demand changes dynamically. Further, combined with the concept of centralized and decentralized information flow control, a dynamic control method of sensitive information flow is established. The security label is formally defined by using the lattice structure, and the control rules of tenants' information flow and the rules of tenant label encryption-declassification are designed. Thus, the independent, dynamic and secure control of tenants' information flow inside and outside the tenant virtual boundary. Finally, the detailed design of a dynamic security control application system for cloud tenants' sensitive information flow is provided. Experiments confirm that the proposed algorithm can identify the security boundary of tenants more accurately and efficiently than the traditional spiking neural network classification methods. Further, the security and effectiveness of the method is verified by the intransitive noninterference theory and the experiment of information flow control.

System Level Protection Against Side-Channel Attack Using High Performance Virtual Secure Circuit for Cryptographic Processor

The proposed system portrays the application space examination of a diverse cryptosystem processor with dynamic reconfiguration abilities. It is appropriate to a variety of signal processing application domains namely telecommunications, image processing, video coding and cryptographic processing. To differentiate between application spaces of the processor, the performance is correlated with cutting edge devices, taking ability to program, energy efficiency and computational potential as the important factors. In general the conventional method of computation is processed by means of Virtual Secure Circuit (VSC) on Advanced Encryption Standard (AES) and performance of the device Field Programmable Gate Array (FPGA) after implementation is analyzed in terms of delay and throughput. In the conventional method area overhead and power consumption are less where as the architecture lags in performance and throughput. It has been overcome through the fully parallel pipelined Architecture of the VSC on AES which outperforms the existing method in terms of performance and throughput. The energy efficiency and performance are considerably more important than processor that are used for general purpose, while still preserving a Convenient approach of programming that mainly bank on software oriented languages. The exploit of VSC based AES is to formulate the cryptographic processor held against Side Channel Attacks like attacks based on power supply and electromagnetic signals. Then the experimental result shows the promising outcomes when compared to previous methods.

Dynamic and Application-Aware Provisioning of Chained Virtual Security Network Functions

A promising area of application for Network Function Virtualization is in network security, where chains of Virtual Security Network Functions (VSNFs), i.e., security-specific virtual functions such as firewalls or Intrusion Prevention Systems, can be dynamically created and configured to inspect, filter or monitor the network traffic. However, the traffic handled by VSNFs could be sensitive to specific network requirements, such as minimum bandwidth or maximum end-to-end latency. Therefore, the decision on which VSNFs should apply for a given application, where to place them and how to connect them, should take such requirements into consideration. Otherwise, security services could affect the quality of service experienced by customers. In this paper we propose PESS (Progressive Embedding of Security Services), a solution to efficiently deploy chains of virtualised security functions based on the security requirements of individual applications and operators' policies, while optimizing resource utilization. We provide the PESS mathematical model and heuristic solution. Simulation results show that, compared to state-of-the-art application-agnostic VSNF provisioning models, PESS reduces computational resource utilization by up to 50%, in different network scenarios. This result ultimately leads to a higher number of provisioned security services and to up to a 40% reduction in end-to-end latency of application traffic.

Virtual Security Functions and Their Placement in Software Defined Networks: A Survey

Software Defined Networking (SDN) and Network Functions Virtualization (NFV) are two important technologies gaining prominence thanks to their benefits for improving the flexibility and cost efficiency in networks. These technologies have been utilized extensively for providing new age security solutions in recent years. Through the use of SDN and NFV, network security functions are virtualized and deployed in a hardware-independent manner, thus reducing costs as well as enabling faster innovations and developments. Functions virtualized with NFV such as firewall, deep packet inspection, intrusion detection systems etc. can reside as applications in the SDN architecture. The issue of where to place these functions in the network is an important problem discussed in the literature. When placing these functions, objectives such as efficient use of network resources, energy consumption, cost, network load, delay etc. must be considered for each function, in addition to ensuring that network security requirements are met. This paper provides a critical survey on the placement of virtualized network security functions in software defined networks and identifies open problems in this field. We briefly describe SDN and NFV technologies, touch upon the relationship between them, exemplify and review the most common virtual security functions in SDN. We also examine and compare the studies on the optimal placement of virtual security functions. Finally, we identify several open research challenges in this area and suggest potential future directions to be considered by researchers.

Mitigating Economic Denial of Sustainability (EDoS) in Cloud Environment using Genetic Algorithm and Artificial Neural Network

Economic Denial of Sustainability (EDoS) is a latest threat in the cloud environment in which EDoS attackers continually request huge number of resources that includes virtual machines, virtual security devices, virtual networking devices, databases and so on to slowly exploit illegal traffic to trigger cloud-based scaling capabilities. As a result, the targeted cloud ends with a consumer bill that could lead to bankruptcy. This paper proposes an intelligent reactive approach that utilizes Genetic Algorithm and Artificial Neural Network (GANN) for classification of cloud server consumer to minimize the effect of EDoS attacks and will be beneficial to small and medium size organizations. EDoS attack encounters the illegal traffic so the work is progressed into two phases: Artificial Neural Network (ANN) is used to determine affected path and to detect suspected service provider out of the detected affected route which further consist of training and testing phase. The properties of every server are optimized by using an appropriate fitness function of Genetic Algorithm (GA) based on energy consumption of server. ANN considered these properties to train the system to distinguish between the genuine overwhelmed server and EDoS attack affected server. The experimental results show that the proposed Genetic and Artificial Neural Network (GANN) algorithm performs better compared to existing Fuzzy Entropy and Lion Neural Learner (FLNL) technique with values of precision, recall and f-measure are increased by 3.37%, 10.26% and 6.93% respectively.

Analyzing the Secure Virtualization schemes and preventions from DDoS flooding Zoombie attacks

Analyzing the Secure Virtualization schemes and preventions from DDoS flooding Zoombie attacks

Cross-VM Branch Prediction Analysis Attack: Scope Assessment and Simulation

Growing scope of cloud computing has made cloud security a challenging parameter. Among all the security parameters, virtualization security requires primary focus as it hides internal resource sharing details of the system. Side Channel Attack (SCA) is an attack that exploits the shared resource for extracting the private key of a cryptographic algorithm. Considering the significance of virtualization security, we need to analyze the SCA in a virtualization environment. In this paper, we target the Branch Prediction Analysis (BPA) Attack, one type of SCA. We have carried out an analysis to verify the scope of various BPA attack launching methods in virtualization environment along with the simulation. We have also analyzed the scope of existing solutions handling BPA attack.

Authentication Issues and Techniques in Cloud Computing Security: A Review

Cloud Computing is a service which is rapidly increasing its growth in IT industry in recent years. The privacy and security is main challenging issue for the cloud users as well providers. The main security issues in Cloud computing are Virtualization Security, Access Control, Authentication, Application Security, Availability of Services etc. Most important issue raised in this era of cloud is Authentication, in which the identity of a user requesting for services are checked. Hence, this paper would like to discuss the methods of user Authentication and Challenges faced in this technique.

Virtualization-Based Security Techniques on Mobile Cloud Computing: Research Gaps and Challenges

The principle constraints of mobile devices are their limited resources such as processing capability, storage space and battery life. While cloud computing offers a vast computing resources services. A new idea emerged by including the cloud computing into mobile devices to augment the capacities of the mobile devices resources such as smartphones, tablet, and other personal digital assistant (PDA) which provides a robust technology called Mobile Cloud Computing (MCC). Although MCC have brought many advantages for the mobile users, it also stills suffer from security and privacy side of data while hosted on virtual machines (VM) on remote cloud’s servers. Currently, the eyes of the security expert’s community turned towards the virtualization-based security technique either on the Cloud or on the mobile devices. The new challenge is to develop secure methods in order to authenticate high sensitive digital content. This paper investigates the main challenges regarding the security and privacy issues in mobile cloud exactly focusing on the virtualization issue layer and give clear strengths and weaknesses of recent relevant virtualization security techniques existing in the literature. Hence, the paper provides perspectives for researchers in order to achieve as a future work.

Enabling Virtual AAA Management in SDN-Based IoT Networks †.

The increase of Software Defined Networks (SDN) and Network Function Virtualization (NFV) technologies is bringing many security management benefits that can be exploited at the edge of Internet of Things (IoT) networks to deal with cyber-threats. In this sense, this paper presents and evaluates a novel policy-based and cyber-situational awareness security framework for continuous and dynamic management of Authentication, Authorization, Accounting (AAA) as well as Channel Protection virtual security functions in IoT networks enabled with SDN/NFV. The virtual AAA, including network authenticators, are deployed as VNF (Virtual Network Function) dynamically at the edge, in order to enable scalable device’s bootstrapping and managing the access control of IoT devices to the network. In addition, our solution allows distributing dynamically the necessary crypto-keys for IoT Machine to Machine (M2M) communications and deploy virtual Channel-protection proxys as VNFs, with the aim of establishing secure tunnels among IoT devices and services, according to the contextual decisions inferred by the cognitive framework. The solution has been implemented and evaluated, demonstrating its feasibility to manage dynamically AAA and channel protection in SDN/NFV-enabled IoT scenarios.