Securing stateful grid servers through virtual server rotation

Abstract

The Grid computing paradigm is aimed at providing seamless access to different kinds of resources, such as compute clusters, data, special appliances and even people. Like most complex IT systems, Grid middleware systems exhibit a number of security problems, and there will always be attacks that are unknown and can circumvent even the best security measures and intrusion detection systems. This creates the requirement that Grid environments should be equipped with intrusion tolerance mechanisms as well as with the traditional intrusion prevention and intrusion detection mechanisms. In this paper, we present a new intrusion tolerance approach which improves the security of stateful WSRF Grid servers against stealth attacks. The proposal is based on a novel server rotation strategy utilizing paravirtualization to close attack windows for stateful service-oriented Grid headnode servers. A flexible plugin based rotation manager deals with the complex issue of stateful connections to the Grid server, and a database connector is utilized to detach service state from the rotating functional components of the Grid server. A prototypical implementation based on the Globus Toolkit 4 is presented.

Optimal Cluster Expansion-Based Intrusion Tolerant System to Prevent Denial of Service Attacks

“…Redundancy is achieved by increasing the VMs, and diversity is achieved with various operating systems and applications. A recovery method is also achieved by using snapshots in the VM-based ITS systems [6,7]. Heo et al [12] introduce a method for finding an optimal exposure time by considering resources in the rotation process of the VM.…”

“…As cloud computing techniques evolve, virtual machine (VM)-based ITSs have attracted the attention of researchers [6,7]. Multiple VMs are used in a host to provide redundancy principles instead of using a backup system.…”

“…However, an SCIT system can be significantly affected by a massive-scale attack like a denial of service (DoS) or distributed DoS (DDoS), because the number of online VMs providing services are fixed in a SCIT system. That is, the total number of processing packets is limited [6,8,9]. To alleviate those problems, an adaptive cluster expansion scheme is necessary to preserve system QoS by rapidly and adaptively increasing the number of online VMs according to a massive packet attack.…”

Effective Proactive and Reactive Defense Strategies against Malicious Attacks in a Virtualized Honeynet

“…As for resource concentration, by modifying the concept of "rotation" discussed in [18][19][20] and adapting it to our scenario, the defender can adopt dynamic responsive strategies to improve system survivability. Hence, while under an attack, the defender can apply dynamic topology reconfiguration to exchange the neighbor of one core node, which has the strongest defensive resources, with a node that is close to the attacker's current location.…”

CReW: Cloud Resilience for Windows Guests through Monitored Virtualization

“…SVGrid provides isolation among applications by running multiple Grid Virtual Machines each running one grid application at a time. Also Smith [18] proposes a separation of grid components currently running on one machine into separate virtual operating systems. This prevents users from installing malicious software and driving inter-users attacks, since each user is confined to his or her own virtual environment.…”