Towards High Assurance Networks of Virtual Machines

Size: px

Start display at page:

Download "Towards High Assurance Networks of Virtual Machines"

Archibald Harrington
5 years ago
Views:

1 Towards High Assurance Networks of Virtual Machines Fabrizio Baiardi 1 Daniele Sgandurra 2 1 Polo G. Marconi - La Spezia, University of Pisa, Italy 2 Department of Computer Science, University of Pisa, Italy EC2ND Conference, /29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

2 Outline 1 Problem Attacks and Evasion of Security Controls 2 3 Security Performance 4 Results and Future Works 2/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

3 Attacks and Evasion of Security Controls Rootkits Rootkits have become more sophisticated over the years. User-level rootkits: usually, modify system binaries. Kernel-level rootkits: for example, a module inserted into the kernel. Unfortunately, rootkits and IDSes work at the same level. A rootkit can attack or evade the IDS controls. 3/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

4 Virtualization Technology Software emulation of the hardware architecture: Virtual Machines (VMs). Benefits: 1 Confinement among the VMs. 2 Server consolidation. 3 Centralized management. Accessing VM s state from a lower level.. 4/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

5 Virtual Machine Monitor A VMM supports the concurrent execution of multiple OSes. 5/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

6 Proposed Approach Problem : Standford University. Visibility: access VM s state from a lower level. Robustness: detect intrusions from another VM. 6/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

7 Multi-Level Approach to Intrusion Detection Semantic gap: introspection can access only raw data. It requires an introspection library to rebuild kernel data structures from another VM and check their integrity. Introspection can be the first step of a chain of trust: 1 Introspection protects kernel integrity. 2 The kernel is extended with further security functions. Customized kernel modules. Security kernel patches: SELinux, LIDS. 3 Standard IDSes run inside the VM. 7/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

8 Chain of Trust Problem 8/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

9 Generalization of the Approach The assurance can be extended to a network of VMs. Each introspection VM monitors the local VMs. Introspection VMs under the same administrative domain establish a trust relationship: Certificates. Ex.: when accessing a service of a VM on another node. Introspection VMs exchange alerts and information on the local VMs. Distributed attacks, worms. Software attestation. 9/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

10 Extending the Assurance Join process. 10/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

11 Architecture The first prototype is based on Xen hypervisor. Introspection VM (IVM): monitors all the VMs. Monitored VMs (Mon-VMs): execute the systems to be monitored. Control Network: supports the exchange of alerts and information among the IVMs. Data Network: supports the exchange of application traffic. 11/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

12 Introspection VM Introspection VM: monitors all the VMs. The introspector protects kernel integrity. Join process: authentication/attestation. 12/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

13 General Approach for Introspection 1 Pause the execution of the VM. 2 Map the memory pages containing the kernel data structure to be monitored. 3 Cast the raw memory into the correct data structure. Linux kernel headers. 4 If there are pointers, map the page containing the referenced address. Ex.: linked list. 5 Apply the consistency checks. 6 Resume the execution of the VM. 13/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

14 General Approach for Introspection Map the memory pages containing the kernel data structure. 14/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

15 General Approach for Introspection Map the memory pages containing the kernel data structure. 15/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

16 General Approach for Introspection Cast the raw memory into the correct data structure. 16/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

17 General Approach for Introspection Map the pages containing referenced addresses. 17/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

18 General Approach for Introspection Map the pages containing referenced addresses. 18/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

19 General Approach for Introspection Map the pages containing referenced addresses. 19/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

20 General Approach for Introspection Apply the consistency checks. 20/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

21 Monitored VM Monitored VM: executes the system to be monitored. It may run IDSes to detect attacks/intrusions. The collector receives all the alerts from the local IDSes. The kernel checks IDSes integrity. 21/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

22 Control Network Problem Control Network: supports the exchange of alerts and commands among the VMs. 22/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

23 Architecture Problem 23/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

24 High Assurance Network of VMs Each IVM has a list of authorized partner IVMs. PEM certificates. We assume VMMs and IVMs are trusted. Small size, no Internet services. Each node is authenticated and protected. Remote software attestation. 24/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

25 Security Performance Attacks Detected Currently, detects: Attacks to the kernel code also those inserting a malicious module. Updates to the IDT and syscall table. Updates to the text area of a critical process. Replacing ps and lsof. Interfaces set into promiscuous mode. 25/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

26 IOzone Read Performance Security Performance We used the IOzone Benchmark Tool to run NFS performance tests on a client Mon-VM. Overhead is less than 10%. 26/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

27 Results and Future Works Limitations Current limitations of the prototype: No checks on kernel dynamic data, such as stack. Other critical kernel data structures, besides IDT and syscall table, have to be protected. Attacking the kernel between each execution of the checks. The join process is static. Distributed attacks: work in progress. 27/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

28 Results and Future Works Results Preventing evasion of the controls and attacks to IDSes. Multi-level approach to form a chain of trust: 1 VMM. 2 Kernel. 3 IDSes. Extending the TCB over multiple physical nodes. Acceptable overhead. 28/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

29 Future Works Problem Results and Future Works A master VM manages and configures the whole network. Checking at runtime kernel invariants. Using abstract interpretation of kernel code. Tracing a VM, such as with ptrace. Verifying system call parameters. Enhanced cooperation among the nodes: Dynamic join process. Worm detection. 29/29 Fabrizio Baiardi, Daniele Sgandurra Towards High Assurance Networks of Virtual Machines

Building Trustworthy Intrusion Detection Through Virtual Machine Introspection

Building Trustworthy Intrusion Detection Through Fabrizio Baiardi 1 Daniele Sgandurra 2 1 Polo G. Marconi - La Spezia, University of Pisa 2 Department of Computer Science, University of Pisa IAS Conference,