Fault Isolation in Hypervisors with Live Migration

ABSTRACT: Cloud computing promises dramatic savings through economies of scale for the government and private sectors, but is also brings security concerns. There is a particular need to prevent faults in or attacks occuring on a virtual machine (VM) from affecting the virtual machines of other users. GrammaTech proposes to address this problem by developing a more secure virtualization system which isolates virtual machines from the controlling hypervisor. Our approach also augments security through dynamic monitoring. Although isolated, the system will maintain the ability perform control tasks such as live migration to relocate virtual machines. This Phase I SBIR research will include development of a Phase I virtualization system prototype with live migration capability. The performance and security of this prototype will be evaluated and compare to existing hypervisor systems. BENEFIT: GrammaTech's approach has the benefit of providing strong isolation between VM's while not sacrificing features such as live migration needed for for practical cloud management. The approach also has the additional benefit of allowing the virtual machines to perform near the level achieved without virtualization. Finally, the approach allows the addition of software protection techiques to automatically attached to the virtual machine using GrammaTech's KATE technology. This technology could be used by cloud providers to secure customer virtual machines and data from attack by other customers. It could also be used by enterprises to protect VMs which provide services which may be attacked, such as public webservers or other network accessible services. This technology can also help such enterprises satisfy regulatory requirements for risk reduction.