Multi-layered Virtual Machines for Security Updates in Grid Environments

Abstract

Abstract-The use of user specific virtual machines (VMs) in Grid and Cloud computing reduces the administration overhead associated with manually installing required software for every user on every computational resource. However, a large number of user specific VMs increases the risk of security attacks. In particular, Cloud computing providers like Amazon suffer from these problems, since they offer different operating systems within VMs and delegate the security update problem for VMs to the users. In this paper, a solution that solves the problem by separating a VM into several layers is presented. The approach creates the possibility of installing security updates into a base layer centrally, affecting all VMs without affecting the users' own installed software stack by merging package databases. The proposal permits resource providers to keep a large number of VMs patched with the latest security fixes without bothering the users. Furthermore, the proposal avoids the overhead for transferring possible large VM images over the network between the nodes of a Grid or Cloud by allowing to hold locally cached VM images with a basic operating system installation while only the user-specific software stack stored in a separate layer needs to be transferred.

Efficient Storage Synchronization for Live Migration in Cloud Infrastructures

“…These requirements are perfectly met by a union file system, as implemented, for example, by aufs or unionfs (which has been deprecated). Our previous work [13] showed that a union filesystem can be used as a root file system.…”

Update Checker: Increasing Virtual Machine Security in Cloud Environments

“…While these solutions can be used to update dormant machines, they suffer from a potential compatibility problem. They "forcibly" install updates, either by changing an underlying layer [5] or by replacing files [4,6], and there is no guarantee that the updates can be safely applied and that they are compatible to the software stack and the configuration of all affected virtual machines.…”

Cloud-Based Desktop Services for Thin Clients

“…In our system architecture, a VD is built from a shared golden image from the OS database, merged with personal settings, for example by using a copy-on-write solution with unionFS. Schwarzkopf et al show how multi-layer VDs simplify the complexity of upgrading the golden image without causing broken dependencies and/or conflicts [3]. To improve the usability of DaaS, combining DaaS with application virtualization technologies such as Softricity and Microsoft App-V is very promising.…”