Security-enhanced live migration based on SGX for virtual machine

Yuan SHI; Huan-guo ZHANG; Bo ZHAO; Zhao YU

doi:10.11959/j.issn.1000-436x.2017183

您当前的位置：

首页 >

文章列表页 >

Security-enhanced live migration based on SGX for virtual machine

Papers | 更新时间：2024-06-05

- Security-enhanced live migration based on SGX for virtual machine
- Journal on Communications Vol. 38, Issue 9, Pages: 65-75(2017)
- 作者机构：
  
  1. 武汉大学计算机学院，湖北武汉 430072
  2. 武汉大学空天信息安全与可信计算教育部重点实验室，湖北武汉 430072
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(61332019);The National Basic Research Program of China (973 Program)(2014CB340600);The National High Technology Research and Development Program (863 Program) of China(2015AA016002)
- DOI：10.11959/j.issn.1000-436x.2017183
  CLC： TP391
- Online First：2017-09，
  
  Published：25 September 2017
- 稿件说明：
移动端阅览
Yuan SHI, Huan-guo ZHANG, Bo ZHAO, et al. Security-enhanced live migration based on SGX for virtual machine[J]. Journal on Communications, 2017, 38(9): 65-75.
DOI：

Yuan SHI, Huan-guo ZHANG, Bo ZHAO, et al. Security-enhanced live migration based on SGX for virtual machine[J]. Journal on Communications, 2017, 38(9): 65-75. DOI： 10.11959/j.issn.1000-436x.2017183.

摘要

针对虚拟机动态迁移面临的虚拟机信息泄露的安全问题，引入内存动态保护技术SGX，基于KVM虚拟化环境，提出一种动态迁移安全增强方法。在迁移两端构建以 SGX 技术为核心的硬件隔离的安全执行环境，保障加密、完整性度量等安全操作和秘密数据的安全。通过迁移双方的安全执行环境之间的远程证明，建立一个用于传输迁移数据的加密信道，并在此基础之上实现迁移双方的平台完整性的相互验证。最后分析该方法的安全增强效果，并通过实验验证了SGX技术的引入不会对迁移造成过多的性能损耗。

Abstract

The virtual machine may face the problem of information leakage in live migration.Therefore

a dynamic memory protection technique SGX was introduced and a security enhancement live migration method based on KVM environment was proposed.Firstly

on both sides of migration

a hardware-isolated secure execution environment centered SGX was built.It guaranteed the security of operations like encryption and integrity measurement and also ensured the security of private data.An encrypted channel to transfer migration data based on the remote attestation between the secure execution environments of both migration sides was constructed.And the mutual authentication of both sides’ platform integrity was realized.Finally

the security enhancement effect and did the experiment was analyzed.The results shows that the introduction of SGX won’t cause much negative effect to the migration performance.

关键词

Keywords

references

邹庆欣 , 郝志宇 , 云晓春 . 基于运行阶段特征的虚拟机实时迁移技术 [J ] . 通信学报 , 2016 , 37 ( 1 ): 170 - 179 .

ZOU Q X , HAO Z Y , YUN X C . Live migration based on the characteristics of operation stages for virtual machine [J ] . Journal on Communications , 2016 , 37 ( 6 ): 170 - 179 .

ZHANG H G , HAN W B , LAI X J , et al . Survey on cyberspace security [J ] . Science China Information Sciences , 2015 , 58 ( 11 ): 1 - 43 .

OBERHEIDE J , COOKE E , JAHANIAN F . Empirical exploitation of live virtual machine migration [C ] // BlackHat DC convention . 2008 .

VAN C A , PIETERS W , WIERINGA R . Security implications of virtualization:a literature study [C ] // IEEE International Conference on Computational Science and Engineering (CES) . 2009 : 353 - 358 .

YAMUNADEVI L , ARUNA P , DEVI D S , et al . Security in virtual machine live migration for KVM [C ] // International Conference on Process Automation,Control and Computing (PACC) . 2011 : 1 - 6 .

CHEN X , GAO X , WAN H , et al . Application-transparent live migration for virtual machine on network security enhanced hypervisor [J ] . China Communications , 2011 , 8 ( 3 ): 32 - 42 .

NAGIN K , HADAS D , DUBITZKY Z , et al . Inter-cloud mobility of virtual machines [C ] // International Conference on Systems and Storage . 2011 : 1 - 12 .

PATIL V P , PATIL G A . Migrating process and virtual machine in the cloud:load balancing and security perspectives [J ] . International Journal of Advanced Computer Science ＆ Information Technology , 2012 , 1 ( 1 ): 11 - 19 .

BIN S N A , MASUDA H . Evaluation of a secure live migration of virtual machines using IPSEC implementation [C ] // IEEE International Conference on Advanced Applied Informatics . 2014 : 687 - 693 .

范伟 , 孔斌 , 张珠君 , 等 . KVM 虚拟化动态迁移技术的安全防护模型 [J ] . 软件学报 , 2016 , 27 ( 6 ): 1402 - 1416 .

FAN W , KONG B , ZHANG Z J , et al . Security protection model on live migration for KVM virtualization [J ] . Journal of Software , 2016 , 27 ( 6 ): 1402 - 1416 .

WANG W , ZHANG Y , LIN B , et al . Secured and reliable VM migration in personal cloud [C ] // International Conference on Computer Engineering and Technology . 2010 : 705 - 709 .

ASLAM M , GEHRMANN C , BJORKMAN M . Security and trust preserving VM migrations in public clouds [C ] // IEEE International Conference on Trust,Security and Privacy in Computing and Communications . 2012 : 869 - 876 .

ANATI I , GUERON S , JOHNSON S , et al . Innovative technology for CPU based attestation and sealing [C ] // International Workshop on Hardware and Architectural Support for Security and Privacy (HASP) . 2013 .

HOEKSTRA M , LAL R , PAPPACHAN P , et al . Using innovative instructions to create trustworthy software solutions [C ] // International Workshop on Hardware and Architectural Support for Security and Privacy (HASP) . 2013 .

Mckeen F , ALEXANDROVICH I , BERENZON A , et al . Innovative instructions and software model for isolated execution [C ] // International Workshop on Hardware and Architectural Support for Security and Privacy (HASP) . 2013 .

BERGER S , CACERES R , et al . vTPM:virtualizing the trusted platform module [C ] // The 15th conference on USENIX Security Symposium . 2006 : 305 - 320 .

SHI Y , ZHAO B , YU Z , et al . A security-improved scheme for virtual TPM based on KVM [J ] . Wuhan University Journal of Natural Sciences , 2015 , 20 ( 6 ): 505 - 511 .

FAN P R , ZHAO B , SHI Y . An improved vTPM-VM live migration protocol [J ] . Wuhan University Journal of Natural Sciences , 2015 , 20 ( 6 ): 512 - 520 .

Views

2674

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Overview of research on trusted attestation technology of cloud virtualization platform

Research on system call forwarding mechanism of SGX-based LibOS

Scheduling framework based on reinforcement learning in online-offline colocated cloud environment

Label-based protection scheme of vTPM secret

Remote attestation scheme for cloud platform based on double-layer unbalanced hash tree

Related Author

Ruina SUN

Kun ZHANG

Haojun XIA

Jie CHENG

Bibo TU

ZHANG Jie

ZHANG Tian

FAN Beixi

Related Institution

China School of Information Management， Xinjiang University of Finance and Economics

School of Cyber Security， University of Chinese Academy of Sciences

Institute of Information Engineering， Chinese Academy of Sciences

School of Mathematics and Computer Science, Shanxi Normal University

Key Laboratory of Data and Intelligent System Security, Ministry of Education

AI问答

⁰