Furnace: Self-service Tenant VMI for the Cloud

Bushouse, Micah; Reeves, Douglas S.

doi:10.1007/978-3-030-00470-5_30

Cited by 5 publications

(1 citation statement)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…CloudVMI [22] provides the VMI interface for cloud customers, which can help them enhance the VM security. Furnace [23] enables cloud customers to execute their VMI-based code in the VMM with high performance. Several papers (e.g., [1]- [3], [9], [10])have studied related issues.…”

Section: Related Workmentioning

confidence: 99%

A Low-Overhead Kernel Object Monitoring Approach for Virtual Machine Introspection

Zhan

et al. 2019

ICC 2019 - 2019 IEEE International Conference on Communications (ICC)

View full text Add to dashboard Cite

Monitoring kernel object modification of virtual machine is widely used by virtual-machine-introspection-based security monitors to protect virtual machines in cloud computing, such as monitoring dentry objects to intercept file operations, etc. However, most of the current virtual machine monitors, such as KVM and Xen, only support page-level monitoring, because the Intel EPT technology can only monitor page privilege. If the out-of-virtual-machine security tools want to monitor some kernel objects, they need to intercept the operation of the whole memory page. Since there are some other objects stored in the monitored pages, the modification of them will also trigger the monitor. Therefore, page-level memory monitor usually introduces overhead to related kernel services of the target virtual machine. In this paper, we propose a low-overhead kernel object monitoring approach to reduce the overhead caused by page-level monitor. The core idea is to migrate the target kernel objects to a protected memory area and then to monitor the corresponding new memory pages. Since the new pages only contain the kernel objects to be monitored, other kernel objects will not trigger our monitor. Therefore, our monitor will not introduce runtime overhead to the related kernel service. The experimental results show that our system can monitor target kernel objects effectively only with very low overhead.

show abstract