Dr. Song Fu 3/22/2010

Size: px

Start display at page:

Download "Dr. Song Fu 3/22/2010"

Duane Burke
6 years ago
Views:

1 CSE 589/489 Virtualization Security Dr. Song Fu song/ 3/22/2010

2 Outline Overview of computer systems Why virtualization Virtualization techniques Virtual machine monitors Virtualization security Summary 2

3 Personal Computers Powerful Quad/Dual-core 3GHz DDR2 400MHz 6400MB/s 4-8GB SATA 7200RPM 3Gb/s 2TB drive Gigabit NIC But under-utilized utilized :( 3

4 # 2 supercomputer p (Top 500) petaflops p Hybrid cell broadband d engine Processors: 6,480 AMD Opteron, 12,960 PowerXCell chips (3200 MHz) - 129K cores Memory: terabytes OS: Linux Interconnect: infiniband Power: megawatts 4

5 Clusters & Grids Glasgow Edinburgh DL Newcastle Belfast Manchester Oxford Cambridge Cardiff RAL London Hinxton Soton Tier0/1 facility Tier2 facility Tier3 facility 10 Gbps link 2.5 Gbps link 622 Mbps link Other link 5

6 Computational Clouds Characteristics Service-oriented computing Transparent to users Easy to use Full control by owners Cloud 4+ billion Web phones by [Source: enabled Nokia] PCs, TVs, etc. Busines ses, from startup s to enterpr ises 6

7 Challenges in Computer Systems Security protection ti Utilization of hardware resource Software installation/updating Scalability and interoperability Load balancing Failure ue isolation soato and failure ueresilience e Energy saving 7

8 Why Virtualization? ti Clearing up the mess created by the success of scale-out One application per commodity x86 server Leads to server sprawl 5-15% CPU utilization typical Failure of popular OSes to provide Full configuration isolation Temporal isolation for performance predictability Strong spatial isolation for security and reliability True backward app compatibility 8

9 Virtualization in the Enterprise Consolidate under under-utilized utilized servers to reduce CapEx and OpEx Avoid downtime with VM Relocation Dynamically re-balance re balance workload to guarantee application SLAs Enforce security policy 3/22/2010 CSE589/489 - Virtualization Vi t li ti Security S it 9

10 Virtual Machine Monitors The VMM is the software behind the virtual machine It hosts multiple guest OS instances Each instance gets its own virtual it lcpu, virtual memory, virtual disk, etc. 10

11 VMM Characteristics ti Programs run under the VMM should exhibit identical effects Most guest instructions should be executed by the physical processor The VMM maintains i complete control of fthe system resources The VMM should be as simple as possible 11

12 VMM Implementation ti CPU Virtualization Memory Virtualization ti Device I/O virtualization Network virtualization ti Control Transfer 3/22/

13 Full Virtualization ti Present the illusion of many small Virtual Machines to run multiple instances of different operating systems concurrently Virtual Machine exactly like physical machine Pros Can run unmodified OSes in VM Virtual hardware greatly reduces the effort to modify/create new OSes (Application-specific OSes) Cons Performance Uncooperative hardware Solution: binary rewriting Examples VMware ESX, VirtualPC, QEMU 13

14 Paravirtualization ti Extending the OS to be aware it is running in a virtualized environment. Present an idealized VM abstraction to guest OSes Differs from underlying hardware interface For performance and enhanced correctness Pros Can deal with difficult-to-virtualizeto architectures Exposing both a virtual and real interface leads to potential t performance enhancements e Higher-level paravirtualizations yield greatest benefit Cons Must port existing OSes to run on paravirtualized host Example Xen, Denali 14

15 Paravirtualization ti vs. Full Virtualization ti User Applications Ring 3 Control Plane User Apps Ring 2 VMM Guest OS Binary Translation Ring 1 Ring 0 Dom0 Guest OS Xen Full Virtualization Paravirtualization 15

16 Existing Research/Products Stanford: Collective project Washington: Denali Purdue: SODA project; secure infrastructure Cambridge: Xen, VM migration VMWare: Virtual Infrastructure Microsoft: Virtual Server IBM: Virtualization Manager 16

17 VMware ESX Server Features CPU virtualization 4-way Virtual SMP Direct SAN LUN mapping, boot from SAN Up to 16GB RAM per VM Can import MS VM Images Can cluster VMs across physical hosts Centralized management using VirtualCenter Good performance Not free: $1000 Standard Edition $5750 Enterprise Edition 17

18 VMware ESX Server Architecture t a l V i r t u Applications Applications Guest OS Guest OS (Linux) (Windows 2000) Virtual Machine Virtual Machine Applications Guest OS (Windows 2003) Virtual Machine a l P h y s i c Virtual Machine Manager (ESX Server) System Hardware 18

19 Xen Hypervisor Virtual machine monitor (VMM) Developed at University of Cambridge An Isolation Kernel Recently included d in mainline Linux Used in many yp production environments 19

20 Xen 3.0 Architecture t VM0 VM1 VM2 VM3 Device Unmodified Unmodified Unmodified Manager & User User User Control s/w Software Software Software GuestOS GuestOS GuestOS Unmodified d G (XenLinux) (XenLinux) (XenLinux) GuestOS (WinXP)) AGP ACPI PCI Back-End Native Device Drivers Front-End Device Drivers SMP Front-End Device Drivers Front-End Device Drivers VT-x x86_32 x86_6464 IA64 Control IF Safe HW IF Event Channel Virtual CPU Xen Virtual Machine Monitor Hardware (SMP, MMU, physical memory, Ethernet, SCSI/IDE) Virtual MMU 20

21 Virtualization at Security

22 Hypervisor Security "hidden hypervisor" attack is a myth, but exploitation of an installed hypervisor is a real and dangerous threat Hypervisors add more software and thus increase the attack surface Network-facing control stack VM containment VMM smaller and defensible than an OS Need a "strength in depth" approach Disaggregate, De-privilege, il narrow interfaces Xen Security Modules from the NSA 22

23 CPU Protection: ti Trap and Emulate 23

24 Memory Protection: Shadow-Mode Maintains i shadow page tables guestreads Virtual Physical guestwrites GuestOS Accessed& Updates dirtybits MMU Virtual Machine VMM Hardware 3/22/

25 Xen Para-Virtualizing i MMU Guest OSes allocate and manage own PTs Hypercall to change PT base Xen must validate PT updates before use Allows incremental updates, avoids revalidation Validation rules applied to each PTE: Guest may only map pages it owns Page table pages may only be mapped RO Xen traps PTE updates and emulates, or unhooks PTE page for bulk updates 25

26 Xen 3.0 I/O Protection ti VM0 VM1 VM2 VM3 Device Unmodified Unmodified Unmodified Manager & User User User Control s/w Software Software Software AGP ACPI PCI GuestOS GuestOS GuestOS Unmodified (XenLinux) (XenLinux) (XenLinux) GuestOS (WinXP)) Back-End Back-End SMP Native Native Device Device Front-End Front-End Driver Driver Device Drivers Device Drivers VT-x 32/64bit Control IF Safe HW IF Event Channel Virtual CPU Xen Virtual Machine Monitor Virtual MMU Hardware (SMP, MMU, physical memory, Ethernet, SCSI/IDE) 26

27 Split Drivers 27

28 Access Control - Device Channel 28

29 Grant Tables Grant tables are a way to control accesses to pages and transfer pages of data between domains Grant other domains access to pages in the system memory allocated to the local domain. Pages can be read, written, or exchanged Provide a fast and secure method for domains to receive indirect access to hardware Fast Driver domains are able to DMA directly into pages in the local domain s memory, Only possible to DMA into pages specified in the grant table. Significant for non-privileged domains Privileged domains could always access the memory of non- privileged il domains 29

30 VM Relocation R l ti VM relocation enables: High-availability High a ailab bilitty Machine M hi maintenance i t Load L db balancing l i g Statistical St ti ti l multiplexing lti l i gain i CSE589/489 - Virtualization Vi t li ti Security S it 30

31 Memory Migration Options Stop-and-copy phase Push phase Pull phase 31

32 Live Relocation Strategy t Stage 0: pre-migration i Stage 1: reservation Stage 2: iterative pre-copy Stage 3: stop-and-copy Stage 4: commitment 3/22/

33 Live Migration: First Iteration ti 33

34 Live Migration: Delta Iteration ti 34

35 Snapshot/Copy-on-Write on Wit Phase 35

36 Tracking Writable Working Set Xen inserts shadow pages under the guest OS, populated using guest OS's page tables. The shadow pages are marked read-only. If OS tries to write to a page, the resulting page fault is trapped by Xen. Xen checks the OS's original page table and forwards the appropriate write permission. If the page is not read-only in the OS's PTE, Xen marks the page as dirty. 36

37 Live Migration for a Web VM 37

38 Secure Virtual Macines 38

39 Embedded d IDS Use virtualization layer to inspect VM Unlike traditional system inside id VM Leverages tech trends: Multicore 39

40 Network Interposition 40

41 Attack-Resistant t t Virtual Hardware Modify virtual hardware to detect attacks prevent e attacks 41

42 Virtual Machine Recovery 42

43 Summary Security layer out of the OS VMM layer as trusted base for security Trust in Virtual Machine VMM layer as security base Virtual TPM and more Virtual even better than real Trustworthy Autonomic Intelligent 43

44 Autonomic Computing Self-managing systems that t Increase Responsiveness Adapt to dynamically y changing environments Business Resiliency Discover, diagnose, and act to prevent disruptions Operational Efficiency Secure Information Tune resources and and Resources balance workloads to Anticipate, detect, maximize use of IT identify, and protect resources against attacks...achieving the correct balance between what is managed by a person versus the system 44

45 Research on Virtualization ti Improving performance Improving virtualization protection and security Apply virtualization for Protection ti & Security Resource management System/service availability Power management 45

46 Useful Resources Virtual Machines: Versatile Platforms for Systems and Processes, J. Smith, Morgan Kaufmann, Xen: / VMware: IEEE Computer Magazine, 38(5), ACM Conf. on Virtual Executive Environments (VEE) USENIX, OSDI, NSDI, SOSP, SC, ICDCS, 46

Virtualization with XEN. Trusted Computing CS599 Spring 2007 Arun Viswanathan University of Southern California

Virtualization with XEN. Trusted Computing CS599 Spring 2007 Arun Viswanathan University of Southern California Virtualization with XEN Trusted Computing CS599 Spring 2007 Arun Viswanathan University of Southern California A g e n d a Introduction Virtualization approaches Basic XEN Architecture Setting up XEN Bootstrapping