VM VM VM VM I/O UVBond VM % 3.2% 2 VM 3 UVBond VM VM VM VM VM VM SSH VNC VM Google [16] 28% [11] 35% [4] VM 1 IaaS VM VM VM VM VM [5]

Size: px

Start display at page:

Download "VM VM VM VM I/O UVBond VM % 3.2% 2 VM 3 UVBond VM VM VM VM VM VM SSH VNC VM Google [16] 28% [11] 35% [4] VM 1 IaaS VM VM VM VM VM [5]"

ちえこやまのかみしゃ
5 years ago
Views:

1 34 (2017 ) VM IaaS IaaS VM VM VM VM VM UVBond UVBond VM VM VM VM VM UVBond Xen VM VM 1 IaaS VM VM VM VM VNC SSH VM VM VM VM VM VM Keisuke Inokuchi, Kenichi Kourai,, Kyushu Institute of Technology. VM VM VM VM VM VM UVBond UVBond VM VM VM UVBond VM VM UVBond VM VM VM UVBond Xen [2] UVBond VM OS

2 VM VM VM VM I/O UVBond VM % 3.2% 2 VM 3 UVBond VM VM VM VM VM VM SSH VNC VM Google [16] 28% [11] 35% [4] VM 1 IaaS VM VM VM VM VM [5][7][8][9][15] VM VM VM VM 1 VM VM VM VM VM 3 UVBond 3. 1 VM VM

3 [3][19] [13] [8] [15] [9] TPM [12] [10] [17] [1] 2 VM VM VM 3. 2 VM VM VM VM UVBond UVBond VM UVBond UVBond VM VM UVBond 2 VM VM VM UVBond VM VM 3 4 VM VM VM VM VM VM VM 3 VM VM VM VM VM 4 VM

xen_version memory_op sysctl sysctl memory_op 1 8 9 10 11 12 domctl domctl x8 memory_op sysctl 13 14

4 xen_version memory_op sysctl sysctl memory_op domctl domctl x8 memory_op sysctl VM VM VM VM 3. 3 VM VM VM UVBond VM VM VM VM UVBond 5 VM VM VM VM 2 VM VM VM UVBond VM VM VM VM VM

5 VM 4 UVBond Xen [2] Xen 0 VM 0 VM VM U WolfSSL [18] AES RSA OpenSSL 4. 1 VM UVBond VM VM AES VM 0 VM VM RSA 0 0 VM 6 0 VM VM VM 4.4 VM 0 VM VM VM 0 VM VM VM I/O VM Xen OS Linux Xen 7 U blkfront 0 blkback I/O

6 0 blkback I/O U blkfront 0 blkback I/O / I/O U blkfront 7 8 VM blkfront I/O blkback I/O VM U blkback I/O blkfront 0 U U 0 I/O XenStore 0 blkfront blkback I/O UVBond 8 U 0 U 0 I/O blkback blkfront U I/O I/O 0 I/O I/O UVBond U U 0 0 0

7 UVBond VM U 0 I/O I/O blkfront XenStore I/O XenStore XenStore I/O XenStore VM I/O I/O I/O blkfront blkfront blkback I/O I/O blkback blkfront I/O AES-NI UVBond CPU AES-NI WolfSSL AES-NI XMM Xen VM CPU XMM XMM AES-NI CR0 TS 4. 3 I/O UVBond I/O I/O OS OS BIOS I/O BIOS IN IN 508 IN AES VM BIOS DMA 4. 4 VM UVBond VM VM VM 0 VM

8 memory_op 1 2 domctl domctl sysctl VM UVBond VM VM 4. 5 VM VM domctl sysctl 0 VM VM VM VM VM VM VM VM VM

9 UVBond CR3 CR3 OS CR3 CR3 5 UVBond Intel Xeon E CPU 8GB 1TB HDD Xen Linux 3.16 U Linux 3.13 VM 2 CPU 2GB 20GB 5. 1 VM VM VM VM VM VM VM s UVBond(AES-NI ) UVBond(AES-NI ) 10 VM 5. 2 VM UVBond VM UVBond AES-NI UVBond 3 0 VM 5 VM 0 10 AES-NI UVBond 5.7 AES-NI AES-NI I/O I/O fio dm-crypt OS VM UVBond AES-

10 180 MB/s dm-crypt UVBond(AES-NI ) UVBond(AES-NI ) MB/s dm-crypt UVBond(AES-NI ) UVBond(AES-NI ) 12 ms UVBond(AES-NI ) UVBond(AES-NI ) 13 NI AES-NI AES-NI UVBond 10% dm-crypt VM 10 UVBond 13 UVBond 2

11 AES-NI 6 Self-Service Cloud SSC [3] VM Udom0 VM Udom0 vtpm SSL Udom0 VM VM vtpm DomB VM DomB SSC VM UVBond VM BitVisor[14] BitVisor VM ATA PIO DMA DMA DMA UVBond OS CloudVisor[19] VM VM VM VM VM FBCrypt[5] UVBond FBCrypt 0 FBCrypt FBCrypt I/O I/O VM 0 UVBond I/O [6] UVBond 7 VM VM VM UVBond UVBond VM VM VM VM UVBond Xen 10% VM

12 VM UVBond libvirt [ 1 ] Azab, A., Ning, P., Wang, Z., Jiang, X., Zhang, X., and Skalsky, N.: HyperSentry: Enabling Stealthy In-context Measurement of Hypervisor Integrity, Proc. Conf. Computer and Communications Security, 2010, pp [ 2 ] Barham, P., Dragovic, B., Fraser, K., Hand, S., Harris, T., Ho, A., Neugebauer, R., Pratt, I., and Warfield, A.: Xen and the Art of Virtualization., Proc. Symp. Operating Systems Principles, (2003), pp [ 3 ] Butt, S., Lagar-Cavilla, H. A., Srivastava, A., and Ganapathy, V.: Self-service Cloud Computing, Proc. Conf. Computer and Communications Security, 2012, pp [ 4 ] CyberArk Software: Global IT Security Service, [ 5 ] Egawa, T., Nishimura, N., and Kourai, K.: Dependable and Secure Remote Management in IaaS Clouds, Proc. Int. Conf. Cloud Computing Technology and Science, [ 6 ] Hofmeyr, S., Forrest, S., and Somayaji, A.: Intrusion Detection Using Sequences of System Calls, Computer Security, Vol. 6(1998), pp [ 7 ] Kourai, K. and Kajiwara, T.: Secure Out-ofband Remote Management Using Encrypted Virtual Serial Consoles in IaaS Clouds, Proc. Int. Conf. Trust, Security and Privacy in Computing and Communications, 2015, pp [ 8 ] Li, C., Raghunathan, A., and Jha, N. K.: Secure Virtual Machine Execution under an Untrusted Management OS, Proc. Int. Conf. Cloud Computing, 2010, pp [ 9 ] Li, C., Raghunathan, A., and Jha, N. K.: A Trusted Virtual Machine in an Untrusted Management Environment, IEEE Trans. Services Computing, Vol. 5, No. 4(2012), pp [10] McCune, J., Parno, B., Perrig, A., Reiter, M., and Isozaki, H.: Flicker: An Execution Infrastructure for TCB Minimization, Proc. European Conf. Computer Systems, 2008, pp [11] PwC: US Cybercrime: Rising Risks, Reduced Readiness, [12] Rutkowska, J. and Wojtczuk, R.: Preventing and Detecting Xen Hyper-visor Subversions, Black Hat USA, [13] Santos, N., Gummadi, K. P., and Rodrigues, R.: Towards Trusted Cloud Computing, Proc. Workshop Hot Topics in Cloud Computing, [14] T. Shinagawa and H. Eiraku and K. Tanimoto and K. Omote and S. Hasegawa and T. Horie and M. Hirano and K. Kourai and Y. Oyama and E. Kawai and K. Kono and S. Chiba and Y. Shinjo and K. Kato: BitVisor: A Thin Hypervisor for Enforcing I/O Device Security, Proc. Int. Conf. Virtual Execution Environments, 2009, pp [15] Tadokoro, H., Kourai, K., and Chiba, S.: Preventing Information Leakage from Virtual Machines Memory in IaaS Clouds, IPSJ Online Trans., Vol. 5(2012), pp [16] TechSpot News: Google Fired Employees for Breaching User Privacy, news/40280-google-fired-employees-for-breachinguser-privacy.html, [17] Wang, J., Stavrou, A., and Ghosh, A.: HyperCheck: A Hardware-Assisted Integrity Monitor, Proc. Int. Symp. Recent Advances in Intrusion Detection, 2010, pp [18] wolfssl Inc.: wolfssl Embedded SSL Library for Applications, Devices, IoT, and the Cloud, [19] Zhang, F., Chen, J., Chen, H., and Zang, B.: CloudVisor: Retrofitting Protection of Virtual Machines in Multi-tenant Cloud with Nested Virtualization, Proc. Symp. Operating Systems Principles, 2011, pp

Vol.53 No (Feb. 2012) IaaS 1 1 1, , IaaS VM VM VM VM VM VM IaaS VM IaaS FBCrypt FBCrypt VNC VMM VM VM FBCrypt Xen TightVNC S

Vol.53 No (Feb. 2012) IaaS 1 1 1, , IaaS VM VM VM VM VM VM IaaS VM IaaS FBCrypt FBCrypt VNC VMM VM VM FBCrypt Xen TightVNC S IaaS 1 1 1,2 2011 11 4, 2011 12 1 IaaS VM VM VM VM VM VM IaaS VM IaaS FBCrypt FBCrypt VNC VMM VM VM FBCrypt Xen TightVNC Secure Out-of-band Remote Management in IaaS Clouds Tomohisa Egawa 1 Naoki Nishimura