Cloud Computing & VM Monitoring

Topics NIST Cloud · Security · Virtualization · VM Introspection
01 //

Cloud Computing Definition

Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (networks, servers, storage, applications, services) that can be rapidly provisioned and released with minimal management effort.

5 Essential Characteristics
  • On-demand self-service
  • Broad network access
  • Resource pooling (sharing)
  • Rapid elasticity
  • Measured service
Common Characteristics

Massive scale, homogeneity, virtualization, resilient computing, low-cost software, geographic distribution, service orientation, advanced security.

02 //

Service & Deployment Models

Service Models

SaaS

Use provider's applications on cloud (e.g. Salesforce, Knowledge Tree)

PaaS

Deploy consumer-created apps with provider tools (e.g. Google Apps)

IaaS

Provision processing, storage, networks (e.g. AWS, Azure)

Deployment Models

Model Description
Private Operated solely for an organization
Community Shared by organizations with shared concerns
Public Available to general public or large industry
Hybrid Composition of two or more models

Model-Specific Risks

SaaS

Data security, data locality, unauthorized access, lost control, provider support

PaaS

SOA/API issues, service lock-in, interoperability

IaaS

VM boundaries, hypervisor security, VM images, vendor equipment trust

03 //

Cloud Security

Security and data privacy are critical barriers to cloud adoption. Key issues: trust, multi-tenancy, encryption, compliance. Clouds are massively complex but built from simple primitives - security is tractable.

Advantages
  • Shifting public data reduces internal exposure
  • Homogeneity simplifies auditing/testing
  • Automated security management
  • Redundancy, disaster recovery
  • Data fragmentation and dispersal
  • Hypervisor protection, rapid reconstitution
Challenges
  • Trusting vendor's security model
  • Customer can't respond to audit findings
  • Loss of physical control
  • Proprietary implementations
  • Multi-tenancy, isolation management
  • Dependence on secure hypervisors

Security-Relevant Components

Core Components
  • Provisioning - rapid reconstitution, honeynet; if compromised, high impact
  • Data Storage - fragmentation, encryption at rest/transit, replication; multi-tenancy, foreign gov exposure
  • Processing - secure master images; application multi-tenancy, hypervisor reliance
  • Support - on-demand controls; risk when integrated with customer apps
  • Network - DDoS protection, VLANs, perimeter; virtual zoning challenges

Encryption

Data Encryption

In transit: ~90% of providers encrypt. At rest: only ~10%. Encrypt resource control interface, admin access, applications. Not all data at rest needs encryption - depends on sensitivity.

04 //

Virtualization

Virtualization is the foundational technology of cloud computing. Cloud "relies on separating applications from the underlying infrastructure." VM is logically isolated from host hardware. Sharing: assign logical name to resource; give each request a pointer.

Type 1 Hypervisor

Installed on bare metal; no host OS. Direct control of hardware.

Type 2 Hypervisor

Runs on host OS; emulates devices. Guest OSs run on top.

Hypervisor Benefits

Increases utilization, enables portability, improves security of physical host.

05 //

VM Monitoring & Introspection

Kernel-level security tools can be compromised by rootkits (same privilege). With virtualization, put the security tool in a separate Security VM - isolated from untrusted VM. The hypervisor has higher privilege; security tool uses introspection to access guest VM contents.

Memory: The Reliable Source

Memory is the only reliable source of current system state. From memory we can extract: running processes, encryption keys, decrypted data, network sockets, OS accounting, user input, screen captures, and more.

Passive vs Active Monitoring

Passive

Security VM takes snapshot of guest raw memory periodically. No timing sync. Uses VM introspection (e.g. libVMI): kernel symbol lookup → page tables → locate kernel data.

Active

Event-driven. Guest triggers event → trampoline transfers control to security app. Hooks protected by hypervisor. Enforces policy, prevents attacks before they complete.

libVMI (XenAccess)

Open-source VM introspection library. Virtual memory translation, kernel symbol mapping, place hooks (memory r/w/x, register r/w, interrupts, single-step). Raw memory → meaningful structures (e.g. process list).

VM Monitoring Overhead

Invocation cost: switching to hypervisor is expensive. Introspection cost: accessing guest memory requires hypervisor calls for page mapping. Fine-grained monitoring amplifies overhead.

06 //

Secure In-VM Monitoring (SIM)

SIM combines out-of-VM security with in-VM performance. Uses hardware virtualization (e.g. Intel VT) so monitor runs in same VM as guest but in separate address space - no hypervisor intervention during invocation; reads/writes at native speed.

Design
  • SIM Address Space - kernel code/data + SIM code/data; isolated via separate page tables
  • Entry Gate / Exit Gate - only ways to switch address spaces; protected by hypervisor
  • CR3 switch - Intel VT allows predefined address-space switch without VM exit
  • Last Branch Recording (LBR) - invocation checker verifies gate called only from allowed hooks
0.47 μs
SIM invocation
5.06 μs
Out-of-VM invocation

SIM is ~10× faster for monitor invocation.

07 //

Summary

Cloud Computing - Takeaways
  • NIST cloud - on-demand, pooled, elastic, measured; SaaS/PaaS/IaaS; Private/Public/Community/Hybrid
  • Security - trust, multi-tenancy, encryption; advantages (homogeneity, reconstitution) vs challenges (vendor trust, physical control)
  • Virtualization - Type 1 (bare metal) vs Type 2 (host OS); hypervisor is key
  • VM introspection - security VM + hypervisor; passive (snapshot) vs active (event-driven); libVMI
  • SIM - in-VM placement with out-of-VM security via separate address space and protected gates

Further Reading

Secure and flexible monitoring of VMs; virtual memory and disk introspection.

SIM: hardware virtualization for protected address space, gates, LBR; low overhead.