Virtual Switching Without a Hypervisor for a More Secure Cloud

Transcription

1 ing Without a for a More Secure Cloud Xin Jin Princeton University Joint work with Eric Keller(UPenn) and Jennifer Rexford(Princeton) 1

2 Public Cloud Infrastructure Cloud providers offer computing resources on demand to multiple tenants Benefits: Public (any one can use) Economies of scale (lower cost) Flexibility (pay-as-you-go) 2

3 Server ization Multiple VMs run on the same server Benefits Efficient use of server resources Backward compatibility Examples Xen KVM VMware VM VM VM 3

4 Network ization switches Run in the hypervisor or the control VM () Benefits: Flexible control at the edge Access control Resource and name space isolation Efficient communication between co-located VMs Examples Open v VMware s v Cisco s Nexus 1000v VM VM 4

5 Security: a major impediment for moving to the cloud! Let s take a look at where the vulnerabilities are 5

6 Vulnerabilities in Server ization Guest VM 1 Guest VM 2 Guest VM 3 The hypervisor is quite complex Large amount of code > Bugs (NIST s National Vulnerability Database) 6

7 Vulnerabilities in Server ization Guest VM 1 Guest VM 2 Guest VM 3 The hypervisor is an attack surface (bugs, vulnerable) > Malicious customers attack the hypervisor 7

8 Vulnerabilities in Network ization Guest VM 1 Guest VM 2 Physical NIC switch in control VM () is involved in communication 8

9 Vulnerabilities in Network ization Guest VM 1 Guest VM 2 Physical NIC switch is coupled with the control VM > e.g., software switch crash can lead to a complete system crash 9

10 Disaggregation [e.g., SOSP 11] Guest VM 1 Guest VM 2 Service VM Service VM Service VM Service VM Disaggregate control VM () into smaller, single-purpose and independent components Malicious customer can still attack hypervisor! 10

11 NoHype [ISCA 10, CCS 11] Emulate, Manage Guest VM 1 Guest VM 2 Physical Device Driver ized Physical NIC Physical Device Driver Pre-allocating memory and cores Using hardware virtualized I/O devices is only used to boot up and shut down guest VMs. Eliminate the hypervisor attack surface What if I want to use a software switch? 11

12 ing in NoHype Emulate, Manage Guest VM 1 Guest VM 2 Guest VM 3 Physical Device Driver Physical Device Driver ized Physical NIC Bouncing packets through the physical NIC Consumes excessive bandwidth on PCI bus and the physical NIC! 12

13 Our Solution Overview Guest VM 1 DomS Guest VM 2 Emulate, Manage Physical NIC Eliminate the hypervisor attack surface Enable software switching in an efficient way 13

14 Eliminate the -Guest Interaction Guest VM 1 Polling FIFO FIFO Shared memory Two FIFO buffers for communication Polling only Do not use event channel; no hypervisor involvement 14

15 Limit Damage From a Compromised Guest Guest VM 1 VM 1 DomS Polling Polling Guest VM 1 DomS PollingFIFO FIFO FIFO FIFO FIFO Decouple software switch from Introduce a Domain (DomS) Decouple software switch from the hypervisor Eliminate the hypervisor attack surface 15

16 Guest VM 1 Preliminary Prototype Native Xen Guest VM 1 Polling FIFO FIFO Our Solution DomS Prototype based on Xen 4.1: used to boot up/shut down VMs Linux 3.1: kernel module to implement polling/fifo Open v

17 Preliminary Evaluation Guest VM 1 Native Xen Guest VM 1 Polling FIFO FIFO Our Solution DomS Evaluate the throughput between DomS and a guest VM, compared with native Xen Traffic measurement: Netperf Configuration: each VM has 1 core and 1GB of RAM 17

18 Evaluation on Throughput FIFO Size Polling period is fixed to 1ms Reach high throughput with just 256 FIFO pages (Only 1MB) Polling Period Shorter polling period, higher throughput CPU resource consumption? > Future work Throughput (Mbps) Throughput (Mbps) FIFO Pages (1 page = 4 KB) Polling Period (ms) 18

19 Comparison with Native Xen Throughput (Mbps) Our Solution Native Xen K 2K 4K 8K 16K Message Size(Bytes) Outperforms native Xen when message size is smaller than 8 KB. Future work: incorporate more optimization 19

20 Conclusion and Future Work Trend towards software switching in the cloud Security in hypervisor and is a big concern Improve security by enabling software switching without hypervisor involvement Future work Detection and remediation of DomS compromise 20

21 Thanks! Q&A 21