Towards automated provisioning of secure virtualized networks

Abstract

We describe a secure network virtualization framework that helps realize the abstraction of Trusted Virtual Domains (TVDs), a security-enhanced variant of virtualized network zones. The framework allows groups of related virtual machines running on separate physical machines to be connected together as though there were on their own separate network fabric and, at the same time, helps enforce crossgroup security requirements such as isolation, confidentiality, security, and information flow control. The framework uses existing network virtualization technologies, such as Ethernet encapsulation, VLAN tagging, and VPNs, and combines and orchestrates them appropriately to implement TVDs. Our framework aims at automating the instantiation and deployment of the appropriate security mechanism and network virtualization technologies based on an input security model that specifies the required level of isolation and permitted network flows. We have implemented a prototype of the framework based on the Xen hypervisor. Experimental evaluation of the prototype shows that the performance of our virtual networking extensions is comparable to that of the standard Xen configuration.

Virtual network security: threats, countermeasures, and challenges

“…This type of attack, often referred to as "eavesdropping" or "sniffing", may lead to theft of confidential information [4,5,20]. Wu et al [20], specifically, mention ARP table poisoning as a means of achieving this.…”

“…In addition to dealing with unauthorized disclosure, Cabuk et al [5] and Wu et al [20] also describe threats related to deception in virtual network environments. Specifically, virtual entities may inject malicious messages into a virtual network, and deceive others into believing that such messages came from another entity.…”

“…Without adequate protection, users from a virtual network might be able to access or even interfere with traffic that belongs to other virtual networks, violating security properties such as confidentiality and integrity [4,5]. Additionally, the infrastructure could be a target for denial of service attacks, causing availability issues for virtual networks instantiated on top of it [6,7].…”

A Survey on Virtual Network Embedding in Cloud Computing Centers

“…There are also some uncommon metrics, such as, the number of active physical nodes [16], delay [41], total allocated bandwidth [37], throughput [41,[48][49][50][51][52][53][54][55][56][57][58][59][60][61][62], etc.…”

On I/O Virtualization Management

“…On the other hand it requires the orchestration of multiple functions of different entities to supply a (virtual) machine with an HBA, making it harder to describe a (virtual) machine's setup. Similar problems arise when creating virtual networks across large infrastructures, as described in [5], that describes a method for instantiating and deploying security and isolation mechanisms in virtualized environments. Rooney et al describe a method for automatic VLAN creation, based on on-line measurement [11], while [3] describes a resource provisioning scheme regarding resource availability.…”