Cloud Verifier: Verifiable Auditing Service for IaaS Clouds

Abstract

Abstract-Cloud computing has commoditized compute, storage, and networking resources creating an on-demand utility. Despite the attractiveness of this new paradigm, its adoption has been stymied by cloud platform's lack of transparency, which leaves customers unsure if their sensitive data and computation can be entrusted to the cloud. While techniques like encryption can protect customers' data at rest, clouds still lack mechanisms for customers to verify that their computations are being executed as expected, a guarantee one could obtain if they were running the computation in their own data center.In this paper, we present the cloud verifier (CV), a flexible framework that cloud vendors can configure to provide cloud monitoring services for customers to validate that their computations are configured and being run as expected in Infrastructure as a Service (IaaS) clouds. The CV builds a chain of trust from the customer to their hosted virtual machine (VM) instances through the cloud platform, enabling it to check customer-specified requirements against a comprehensive view of both the VM's load-time and run-time properties. In addition, the CV enables cloud vendors to provide more responsive remediation techniques than traditional attestation mechanisms. We built a proof of concept CV for the OpenStack cloud platform whose evaluation demonstrates that a single CV enables over 20,000 simultaneous customers to verify numerous properties with little impact on cloud application performance. As a result, the CV gives cloud customers a low-overhead method for assuring that their instances are running according to their requirements.

Efficient Certification and Zero-Knowledge Proofs of Knowledge on Infrastructure Topology Graphs

“…It provides us with proofs of knowledge that show elaborate statements on topology security properties, while keeping the topology itself confidential. Our work complements existing results in the tenant-verifiable integrity of infrastructures with host-based monitoring [34] and the attestation of physical hosts and virtual machines [8]: Graph signatures offer the confidential attestation of the system structure and enable a provider to convince a verifier that the system is structured securely, while keeping the blueprint of the system secret.…”

“…TPM-protected host-based monitoring of virtualized infrastructures offers an alternative to structural security assurance. Cloud Verifier [34], for example, allows a remote tenant to specify integrity criteria for which Cloud Verifier will monitor a node server. This approach employs an integrity verification proxy as well as TPM support for attestation.…”

LibSEAL

“…Auditing-as-a-service [85,89,90,114] requires a trusted third party to maintain an audit logs for detecting integrity violations. LibSEAL does not require a trusted third party, but can instead rely on the TEE for privacy and integrity.…”

Cloud radar

“…The different goals and motivations of vQuery and Cloud Radar (performance versus security) are reflected in the model and configuration translation, where vQuery models many performance metrics and Cloud Radar focuses on capturing the topology and its security. Schiffman et al [13] proposed a monitoring system called Cloud Verifier that allows to monitor hosts and virtual machines with regard to integrity requirements, e.g., based on trusted computing mechanisms.…”

“…Existing research in this space is mostly focused on dynamic infrastructure analysis of non-security properties [14], node integrity monitoring [13] or establishing security analyses of static systems given by a configuration snapshot [2]. While the latter results give us confidence about reasoning on security consequences of infrastructure cloud topology and configurations, they suffer from blind spots due to transient security failures as well as from efficiency problems.…”