Improving Users' Isolation in IaaS: Virtual Machine Placement with Security Constraints

Abstract

International audienceNowadays virtualization is used as the sole mechanism to isolate different users on Cloud platforms. We will show that due to improper virtualization of micro-architectural components, data leak and modification can occur on public Clouds. Furthermore, using the same vector, it is possible to induce performance interferences, i.e. noisy neighbors. Using this approach, a VM can slow down and steal resources from concurrent VMs. We propose placement heuristics that take into account isolation requirements. We modify three classical heuristics to take into account these requirements. Furthermore, we propose four new heuristics that take into account the hierarchy of the Cloud platforms and the isolation requirements. Finally, we evaluate these heuristics and compare them with the modified classical ones. We show that our heuristics are performing at least as good as classical ones but are scaling better and are faster by a few order of magnitude than the classical ones

Deep reinforcement learning for multi-objective placement of virtual machines in cloud datacenters

“…As a consequence, all the hosted VMs become unavailable as well. An additional feature to take into account is the possible presence of applications requiring to run VMs in a secure environment (Caron and Cornabas 2014;Jhawar et al 2012). This may prevent the coexistence of VMs running on the same PM.…”

Microarchitecture-Aware Virtual Machine Placement under Information Leakage Constraints

“…Others existing preventive approaches are dedicated instances or collocation/anti-collocation placement. In this case, the isolation properties can be modelized as collocation and anticollocation constraints [3], [7]. Nevertheless, they require to express the list of tenants with whom each VM is allowed to share resources (or not).…”