SAVM: A practical secure external approach for automated in‐VM management

Abstract

Summary In‐VM management is usually needed by cloud service providers for cloud management, which includes monitoring the in‐VM application running state, reconfiguring VM system settings, etc. In‐VM management is also very useful in green cloud computing, because it provides the abilities of in‐VM monitoring, VM reconfiguration, performance measurement, etc. Leveraging a shell or an in‐VM agent to manage VMs is faced with generality and security challenges. In this paper, we propose a secure automated in‐VM management approach, ie, SAVM, which likes a hypervisor‐based shell managing the VMs in an out‐of‐box way. To bridge the semantic gap, we reuse the target VM's system calls to process the semantic information automatically. More importantly, we introduce a secure instruction fetch approach to enhance the system security. As a result, SAVM does not rely on the target VM's kernel integrity. In addition, we also present a dummy process selection and a system call injection method to further enhance the system security and transparency. After the implementation, we evaluate the prototype. The experimental results show that SAVM can achieve most of the in‐VM management operations. Furthermore, SAVM can work correctly under the target VM attacked by several popular rootkits.

A Low-Overhead Kernel Object Monitoring Approach for Virtual Machine Introspection

“…By converting a process within the target VM to a dummy process, ShadowContext leverages the dummy process to invoke some system calls to narrow the semantic gap automatically. SAVM [20] and HyperShell [21] are some in-VM management tools, which also leverage the system call reuse technology.…”

Foreword to the special issue of green cloud computing: Methodology and practice

“…This issue would be incomplete without in‐VM management and it is very useful in green cloud computing because it provides the abilities of in‐VM monitoring, VM reconfiguration, and performance measurement. Zhan et al propose a secure automated in‐VM management approach, a hypervisor‐based shell managing the VMs in an out‐of‐box way. In addition, it presents a dummy process selection and a system call injection method to further enhance the system security and transparency.…”