Enabling secure VM-vTPM migration in private clouds

Abstract

The integration of Trusted Computing technologies into virtualized computing environments enables the hardware-based protection of private information and the detection of malicious software. Their use in virtual platforms, however, requires appropriate virtualization of their main component, the Trusted Platform Module (TPM) by means of virtual TPMs (vTPM). The challenge here is that the use of TPM virtualization should not impede classical platform processes such as virtual machine (VM) migration.In this work, we consider the problem of enabling secure migration of vTPM-based virtual machines in private clouds. We detail the requirements that a secure VM-vTPM migration solution should satisfy in private virtualized environments and propose a vTPM key structure suitable for VM-vTPM migration. We then leverage on this structure to construct a secure VM-vTPM migration protocol. We show that our protocol provides stronger security guarantees when compared to existing solutions for VM-vTPM migration. We evaluate the feasibility of our scheme via an implementation on the Xen hypervisor and we show that it can be directly integrated within existing hypervisors. Our Xenbased implementation can be downloaded as open-source software. Finally, we discuss how our scheme can be extended to support live-migration of vTPM-based VMs.

Virtual machine security

“…The security analysis based on Xen hypervisor elucidates the feasibility of the migration of VM supported by virtual TPM in the private cloud (Danev et al, 2011).…”

Infrastructure as a service: Exploring network access control challenges

“…We can conclude that LVMM security is a critical issue in IaaS and it faces serious security challenges that need to be addressed and considered as an open research topic. There is a trend to secure LVMM through vTPM [39]. Nevertheless, TPM-based measurements are ineffective for detecting a malicious cloud service provider as well as having limitations in verifying the hypervisor integrity in public clouds via remote attestation [40].…”

Migration-based virtual machine placement in cloud systems

“…Such resource multiplexing largely reduces the total cost of ownership, and significantly improves the resource utilization. As a contribution of virtualization technology, VM migraton [13][14][15][16][17][18] improves the resource rearrangement on the fly.…”