When dynamic VM migration falls under the control of VM user

Size: px

Start display at page:

Download "When dynamic VM migration falls under the control of VM user"

Samuel Cole
5 years ago
Views:

ZHENG IMT/OLPS/ASE/SEC/NPS Orange Labs, Caen Jalel

sécurité des technologies de l'information et des

1 When dynamic VM migration falls under the control of VM user Kahina LAZRI, Sylvie LANIEPCE, Haiming ZHENG IMT/OLPS/ASE/SEC/NPS Orange Labs, Caen Jalel Ben-Othman L2TI laboratory Paris13 Symposium sur la sécurité des technologies de l'information et des communications. SSTIC 14. Friday 6 th June, Rennes.

2 Outline Problem Definition Dynamic Resource Management Vulnerability VMware Distributed Resource Scheduler (DRS) algorithm analysis Attack scheme Cluster vulnerability assessment Demonstration Conclusion 1

3 Scope Domain of new vulnerabilities appeared with cloud (virtualization) Resource Sharing & Multi-tenancy: cross-virtual Machine attacks (cross-vm) Dynamic resource management Elasticity <-> Dynamicity (today) Resource Overcommitment VM Migration 1

4 Resource sharing and dynamic resource allocation Input : Quantity of consummed resources (Malicious+Normal VMs) Dynamic Resource Management System Output : Decisions impact Normal VMs Infrastructure Normal VM Normal VM Malicious VM Normal VM Malicious VM Normal VM Shared Resource Pool -> Fate-sharing Demonstrate that dynamic resource management systems might be vulnerable to malicious manipulation of VM resource consumption Abuse: cause the resource management system to trigger VM migrations Cost for both the infrastructure and migrated VMs 2

5 unbalanced Distributed Resource Scheduler Algorithm (DRS, VMware) Constraint Correction calculate chlsd yes While cluster imbalanced: GetBestMove I c > I t no Do nothing For each VM in the cluster simulate vmotion and calculate CHLSD While cluster imbalanced: GetBestMove Weight Costs vs. Benefits vs. Risks Return migration that does not exceed CBR threshold I c : Current Imbalance (chlsd: Current Host Load Standard Deviation) I t : Target Imbalance (thlsd: Target Host Load Standard Deviation) Add to migration recommendation list and give a priority rating Re-calculate I c balanced Apply migration source: VMware vsphere 4.1 HA and DRS. technical Deepdive. D.Epping et F. Denneman Done 3

6 DRS: Target Imbalance (I t ) analysis I t = Constant Aggressiveness Cluster Size Four Aggressiveness Levels enabling dynamic migrations: Moderately Conservative Moderate (Default) Moderately Aggressive Aggressive Abusive VM Migration Attack: deliberately manipulate the quantity of resources consumed by VMs to enforce DRS to trigger VM migrations : I c > I t 4

7 Experimentation Setup DRS vmotion vcenter Management Server (VMware) Context 5 Hosts 16 GB of RAM each 8 CPU x GHz each VMs / Host = 10 % Overcommitment Mem = 13.18% (17.5 GB) CPU = 25% (10 vcpu) Resource Usage in normal VMs Real private IaaS cloud traces Virtual Platform Analysis Tools (Orange Labs) Load Generator Monitoring Diagnosis 5

8 Abusive VM Migration Attack: one shot 6

9 Coordinated Abusive VM Migration Attack: Serial Migration Fig.1 Attacker VM Fig. 2 - Imbalance Attack conditions: - Attacker coordinates VMs on two different hosts - VMs fluctuate their resource consumption in phase opposition between the two hosts 7

Minimum Required Resource Minimum Required Resource Minimum Required Resource Minimum Required Resource Vulnerability Measurement (small cluster) Minimum quantity Vulnerability of resources increases

10 Minimum Required Resource Minimum Required Resource Minimum Required Resource Minimum Required Resource Vulnerability Measurement (small cluster) Minimum quantity Vulnerability of resources increases to be when under cluster the size control increases of the attacker? Cluster vulnerability is high when this quantity is low Vulnerability increases when DRS Aggressiveness increases Moderately Conservative 11, , Moderate (Default) Memory (GB) CPU (vcpu) Cluster Size (N) Cluster Size (N) Moderately Aggressive Cluster Size (N) 3 2,5 2 1,5 1 0,5 0 2,5 Agressive Cluster Size (N) Context: one shot Abusive VM Migration attack, execution context described in slide 8 8

11 Demonstration 19

12 Conclusion How to autonomously mitigate such threats? Proactive Integrating security considerations in dynamic resource management systems design? Reactive Autonomic Monitoring and detection of malicious resource consumption profiles How to characterize such profiles? How to deal with these profiles? 10

13 Thank you Questions?

Vmware VCP550PSE. VMware Certified Professional on vsphere 5.

Vmware VCP550PSE. VMware Certified Professional on vsphere 5. Vmware VCP550PSE VMware Certified Professional on vsphere 5 http://killexams.com/exam-detail/vcp550pse QUESTION: 108 A virtual machine fails to migrate during a Storage DRS event. What could cause this