The Community for Technology Leaders
Green Image
Issue No. 03 - July-Sept. (2017 vol. 5)
ISSN: 2168-7161
pp: 390-404
Yubin Xia , Institute of Parallel and Distributed Systems, Shanghai Jiao Tong University, Shanghai, China
Yutao Liu , Institute of Parallel and Distributed Systems, Shanghai Jiao Tong University, Shanghai, China
Haibing Guan , Department of Computer Science, Shanghai Jiao Tong University, Shanghai, China
Yunji Chen , Institute of Computing Technology, Chinese Academy of Sciences, China
Tianshi Chen , Institute of Computing Technology, Chinese Academy of Sciences, China
Binyu Zang , Institute of Parallel and Distributed Systems, Shanghai Jiao Tong University, Shanghai, China
Haibo Chen , Institute of Parallel and Distributed Systems, Shanghai Jiao Tong University, Shanghai, China
ABSTRACT
Computation outsourcing using virtual appliance is getting prevalent in cloud computing. However, with both hardware and software being controlled by potentially curious or even malicious cloud operators, it is no surprise to see frequent reports of security accidents, like data leakages or abuses. This paper proposes Kite, a hardware-software framework that guards the security of tenant’s virtual machine (VM), in which the outsourced computation is encapsulated. Kite only trusts the processor and makes no security assumption on external memory, devices, or hypervisor. Unlike prior hardware-based approaches, Kite retains transparency with existing VM and requires few changes to the (untrusted) hypervisor by introducing VM-Shim mechanism. Each VM-Shim instance runs in between its VM and the hypervisor, which only transfers necessary information designated by the VM to the hypervisor and external environments. Kite also considers the high-level semantic of interaction between VM and hypervisor to defend against attacks through legitimate operations or interfaces. We have implemented a prototype of Kite’s secure processor in a QEMU-based full-system emulator and its software components on real machine. Evaluation shows that the performance overhead of Kite ranges from 0.5-14.0 percent on simulated platform and 0.4-7.3 percent on real hardware.
INDEX TERMS
Virtual machine monitors, Software, Security, Hardware, Virtualization, Context, Outsourcing
CITATION

Y. Xia et al., "Secure Outsourcing of Virtual Appliance," in IEEE Transactions on Cloud Computing, vol. 5, no. 3, pp. 390-404, 2017.
doi:10.1109/TCC.2015.2469657
246 ms
(Ver 3.3 (11022016))