Towards automated security policy enforcement in multi-tenant virtual data centers

Abstract

Virtual data centers allow the hosting of virtualized infrastructures (networks, storage, machines) that belong to several customers on the same physical infrastructure. Virtualization theoretically provides the capability for sharing the infrastructure among different customers. In reality, however, this is rarely (if ever) done because of security concerns. A major challenge in allaying such concerns is the enforcement of appropriate customer isolation as specified by high-level security policies. At the core of this challenge is the correct configuration of all shared resources on multiple machines to achieve this overall security objective.To address this challenge, this paper presents a security architecture for virtual data centers based on virtualization and Trusted Computing technologies. Our architecture aims at automating the instantiation of a virtual infrastructure while automatically deploying the corresponding security mechanisms. This deployment is driven by a global isolation policy, and thus guarantees overall customer isolation across all resources. We have implemented a prototype of the architecture based on the Xen hypervisor.

Current and Emerging Trends in Cyber Operations

“…Also, the data center industry is using architecture that automates a virtual infrastructure while automatically applying relevant security mechanisms associated with information-exchange policy (Cabuk et al 2010). These applications are interesting because they provide examples of some challenges related to the release of information based on levels of trust and operational context; translating legislative mandates, policy, and information-sharing agreements; and transforming information-exchange policies into system-enforceable rules.…”

Virtualized hosting: Devising a security policy through log analysis

“…Different virtual machines can run different operating systems and multiple applications on the same physical computer. As many organizations are leaping aboard the virtualization bandwagon now [5,6], they need the management tools to run those machines and support a wide selection of applications and infrastructure services their businesses depend on. The ability to build a virtual infrastructure with a proven platform that scales across hundreds of interconnected physical computers and storage devices is critical to successful management of any data center.…”

“…Notwithstanding that some features of virtualization can enhance security, many unknown threats are troublesome and dealing with the unknowns can be risky [4]. A popular way to cope with complexities of virtualization involves extensive automation of processes [5]. While automation offers some degree of promise, it requires a well thought-out and effective security policy in place to drive the automation.…”

“…It requires careful consideration of assigning servers, storage space, and network bandwidth to every application. A well developed virtualization plan using an effective security protocol can increase service availability and reduce the physical complexity of the design [5]. To begin, we present an overview on three major concerns: physical host configurations, backup strategy and side-channel attacks, an increasingly common threat to virtualized zones [7].…”

Towards flexible, scalable and autonomic virtual tenant slices

“…For example, Cabuk et al (Cabuk et al (2010)) presented prototype of automated security policy enforcement for multi-tenancy based on the concept of Trusted Virtual Domains (TVDs). Their approach allows to group VMs belonging to a specific tenant dispersed across multiple Xen Hypervisor into a TVD zone.…”