DOCSLIB.ORG

Multilevel Classification in Selinux

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Multilevel Classification in Selinux Masaryk University Faculty}w¡¢£¤¥¦§¨ of Informatics!"#$%&'()+,-./012345<yA| Multilevel Classification in SELinux Master’s thesis Bogdan Iakym Brno, autumn 2012 Declaration Hereby I declare, that this paper is my original authorial work, which I have worked out by my own. All sources, references and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Bogdan Iakym Advisor: Ing. Mgr. Zdeněk Říha, Ph.D. ii Acknowledgement First of all, I would like to thank my advisor, Ing. Mgr. Zdeněk Říha, Ph.D., for his guidance and helpful advices. Many thanks go also to the other col- leagues from the Laboratory of Security and Applied Cryptography. Last but not least, I am grateful to my family and friends for their love and support. Thank you all. iii Abstract Multilevel Security (MLS) systems classify data, based on their confidential- ity or integrity. One of possible implementation of MLS system is SELinux, that enforces Bell-LaPudula model (BLP). The goal of this work is to study and analyze basic components of MLS policy in SELinux. This studying includes practical experiments related to File System, Inter-Process Com- munication, Polyinstantiation, Application and Database Support of MLS. The goal of the practical part is to design, implement and test the config- uration of MLS policy, applicable for Apache web server. Finally, this work analyzes the benefits that can be brought by MLS to the security ofweb services and the areas in which such systems could be deployed. iv Keywords SELinux, MLS, security policy, configuration, Bell-LaPadula model, integrity, confidentiality, security level, access control. v Contents 1 Introduction .............................3 1.1 Problematic Area .........................3 1.2 Thesis Outline ..........................4 2 SELinux Overview ..........................5 2.1 Introduction ............................5 2.2 Objects and Subjects .......................7 2.3 Type Enforcement Mechanism .................8 2.3.1 Security Context . .8 2.3.2 Types and Attributes . .8 2.3.3 Access Vector Rules . .9 2.3.4 Domain Transition . 10 2.3.5 Constraints . 11 2.4 Role Based Access Control .................... 11 2.4.1 Role Statements . 12 2.4.2 Users and Roles . 13 2.4.3 Mapping between Linux and SELinux Users . 13 2.5 Audit Logs ............................ 14 2.6 Booleans .............................. 15 2.7 Object Labeling .......................... 16 2.8 SELinux Policies ......................... 17 2.9 Policy Modules .......................... 18 2.10 The Reference Policy ....................... 20 2.11 Summary ............................. 21 3 SELinux Tools for MLS ...................... 23 3.1 Introduction ............................ 23 3.2 Security Levels .......................... 23 3.2.1 Sensitivities . 24 3.2.2 Categories . 25 3.2.3 Implementation in the Reference Policy . 26 3.2.4 Security Level Translation . 27 3.3 mlsconstrain Statements ..................... 27 3.4 mlsvalidatetrans Statements ................... 29 3.5 Privilege Management ...................... 30 3.6 Semantics of MLS Policy ..................... 31 3.7 MLS support ........................... 34 3.7.1 File System . 35 3.7.2 Inter-Process Communication . 36 1 3.7.3 Application Support Analysis . 38 3.7.4 Polyinstantiation . 40 3.7.5 SE-PostgreSQL . 43 3.7.6 Apache SELinux Plus . 44 3.8 Summary ............................. 46 4 Apache Configuration with MLS Policy ............ 47 4.1 Introduction ............................ 47 4.2 Design of the Configuration ................... 47 4.3 Deployment of the MLS system ................. 49 4.3.1 Development Environment . 49 4.3.2 Authentication . 50 4.3.3 Typebounds Approach . 52 4.3.4 Writing Policy Module . 53 4.4 Testing .............................. 60 4.4.1 Functionality Tests . 60 4.4.2 Performance Analysis . 62 4.5 Summary ............................. 67 5 Conclusion .............................. 69 A The CD contents .......................... 76 2 1 Introduction 1.1 Problematic Area We live in the information age, when a huge amount of data are stored in the computer systems. At the same time, we also know how many attacks aimed to compromise, manipulate and disrupt these data are currently possible. It is not something new to claim how important is to be aware of security mechanisms to protect so expensive information resources. Fundamental se- curity goals of each system are confidentiality, integrity and availability of information. Confidentiality relates to preventing unauthorized access to information that should be only disclosed to authorized ones. Therefore, a part of con- fidentiality protection is also authentication that controls whether an entity is who it claims to be. Confidentiality often refers to protection against ma- licious software, spam, phishing and different means of social engineering, where an attacker attempts to obtain confidential information such as user account passwords, numbers of credit cards or different types of personal information. The purpose of integrity protection is to ensure that data were not changed inappropriately. Violation of integrity includes accidental or delib- erate attempts to modify, insert or destruct data by unauthorized entities. Systems that are secure in terms of confidentiality or integrity should also remain available. In other words, information resources should be avail- able whenever the authorized users request them. Otherwise, implemented security mechanisms would be meaningless. Practical implementation of secure computer systems results in a va- riety of access controls. Nowadays, operating systems are more and more focused on improvment of different security means whose goal is to provide customers with truly qualitive product. One of them is operating system Linux, which primary comes with Discretionary Access Control(DAC). It is dominant access control, that we have today. In short, DAC is based on the concept that individual users can specify who may or may not access the resource. These restrictions define permissions for particular users, groups and all others. However, all DAC mechanisms have a fundamental weakness in that they are not able to recognize critical difference between human users and computer programs.[1] In other words, a program has the same access capabilities as the owner of this program, hence, malicious programs, such as "Trojan horses" could be able to obtain superuser privileges. The mechanism 3 1. Introduction of Mandatory Access Control(MAC) was called to solve this issue. The key difference between these approaches is that access control decisions inMAC are not delegated to individual users, but to special security policies that define a strict set of permissions for each component of a system. Oneofthe most common MAC mechanism is multilevel security. The term "Multilevel Security"(MLS) comes from a military community. Documents in a military are often labeled according to their sensitivity lev- els, ranging from unclassified (anyone can see this) to confidential, secret, top secret, etc. In the 1970s similar concepts started to be considered for implementation in computer systems. The primary goal was to provide data with powerfull integrity and confidentiality protection mechanisms. As a re- sult, such famous MLS models as High-water mark, Bell-LaPudula, Biba and others appeared. In any MLS model access control verifies whether a par- ticular subject has the required clearance to access an object with a given classification. Long time deployment of MLS in computer systems was considered as a complex, nontrivial task. After implementation of Mandatory Access Con- trol(MAC) on Linux Operation System, idea of using multilevel security sys- tems seems to be not just attractive, but really feasible. Security-Enhanced Linux(SELinux) project is an example of such implementation and currently integrated into Linux kernel from the version 2.6. It provides an access con- trol, based on flexible configuration of different types of security policies. As a result, from the kernel 2.6.12 SELinux supports MLS policy. Probably, this is the most accessible and opened MLS system that we have today. In terms of confidentiality and integrity protection, this mechanism presents powerfull tool, and all its details will be analyzed throughout this work. 1.2 Thesis Outline The thesis is divided into five chapters. Chapter 1 is this introduction. Main SElinux concepts and components are presented in Chapter 2. MLS policy details are described in Chapter 3. In Chapter 4 the design, implementation and testing of the target configuration is presented. Chapter 5 concludes the thesis. 4 2 SELinux Overview 2.1 Introduction MLS policy was implemented as a new type of SELinux policy together with other MAC mechanisms such as Type Enforcement(TE). However, without understanding basic SELinux concepts it will be difficult to apply and use effectively MLS tools. So, this introduction presents a brief historical notes of SELinux evolution and the purpose of its emergence. If we look at the history of SELinux, we will find that first projects related to this research started from the 1980s. At this time high-assurance operating system security and microkernel research merged in the project Distribute Trusted Math(DTMach).[1] Later The U.S. National Security Agency’s re- search organization took part in this research and developed a number of sub- sequent microkernel projects. The result of this work was completely
Load more

Recommended publications
  • NSA Security-Enhanced Linux (Selinux)
    Integrating Flexible Support for Security Policies into the Linux Operating System http://www.nsa.gov/selinux Stephen D. Smalley [email protected] Information Assurance Research Group National Security Agency ■ Information Assurance Research Group ■ 1 Outline · Motivation and Background · What SELinux Provides · SELinux Status and Adoption · Ongoing and Future Development ■ Information Assurance Research Group ■ 2 Why Secure the Operating System? · Information attacks don't require a corrupt user. · Applications can be circumvented. · Must process in the clear. · Network is too far. · Hardware is too close. · End system security requires a secure OS. · Secure end-to-end transactions requires secure end systems. ■ Information Assurance Research Group ■ 3 Mandatory Access Control · A ªmissing linkº of security in current operating systems. · Defined by three major properties: ± Administratively-defined security policy. ± Control over all subjects (processes) and objects. ± Decisions based on all security-relevant information. ■ Information Assurance Research Group ■ 4 Discretionary Access Control · Existing access control mechanism of current OSes. · Limited to user identity / ownership. · Vulnerable to malicious or flawed software. · Subject to every user©s discretion (or whim). · Only distinguishes admin vs. non-admin for users. · Only supports coarse-grained privileges for programs. · Unbounded privilege escalation. ■ Information Assurance Research Group ■ 5 What can MAC offer? · Strong separation of security domains · System, application, and data integrity · Ability to limit program privileges · Processing pipeline guarantees · Authorization limits for legitimate users ■ Information Assurance Research Group ■ 6 MAC Implementation Issues · Must overcome limitations of traditional MAC ± More than just Multi-Level Security / BLP · Policy flexibility required ± One size does not fit all! · Maximize security transparency ± Compatibility for applications and existing usage.
    [Show full text]
  • An Access Control Model for Preventing Virtual Machine Escape Attack
    future internet Article An Access Control Model for Preventing Virtual Machine Escape Attack Jiang Wu ,*, Zhou Lei, Shengbo Chen and Wenfeng Shen School of Computer Engineering and Science, Shanghai University, Shanghai 200444, China; [email protected] (Z.L.); [email protected] (S.C.); [email protected] (W.S.) * Correspondence: [email protected]; Tel: +86-185-0174-6348 Academic Editor: Luis Javier Garcia Villalba Received: 26 March 2017; Accepted: 23 May 2017; Published: 2 June 2017 Abstract: With the rapid development of Internet, the traditional computing environment is making a big migration to the cloud-computing environment. However, cloud computing introduces a set of new security problems. Aiming at the virtual machine (VM) escape attack, we study the traditional attack model and attack scenarios in the cloud-computing environment. In addition, we propose an access control model that can prevent virtual machine escape (PVME) by adapting the BLP (Bell-La Padula) model (an access control model developed by D. Bell and J. LaPadula). Finally, the PVME model has been implemented on full virtualization architecture. The experimental results show that the PVME module can effectively prevent virtual machine escape while only incurring 4% to 8% time overhead. Keywords: virtual security; virtual machine escape; access control; BLP model; PVME model 1. Introduction Cloud computing treats IT resources, data and applications as a service provided to the user through network, which is a change in the way of how data is modeled. Currently, the world’s leading IT companies have developed and published their own cloud strategies, such as Google, Amazon, and IBM.
    [Show full text]
  • Multilevel Security (MLS)
    Multilevel Security (MLS) Database Security and Auditing Multilevel Security (MLS) Definition and need for MLS – Security Classification – Secrecy-Based Mandatory Policies: Bell- LaPadula Model – Integrity-based Mandatory Policies: The Biba Model – Limitation of Mandatory Policies Hybrid Policies – The Chinese Wall Policy Definition and need for MLS Multilevel security involves a database in which the data stored has an associated classification and consequently constraints for their access MLS allows users with different classification levels to get different views from the same data MLS cannot allow downward leaking, meaning that a user with a lower classification views data stored with a higher classification Definition and need for MLS Usually multilevel systems are with the federal government Some private systems also have multilevel security needs MLS relation is split into several single-level relations, A recovery algorithm reconstructs the MLS relation from the decomposed single-level relations At times MLS updates cannot be completed because it would result in leakage or destruction of secret information Definition and need for MLS In relational model, relations are tables and relations consist of tuples (rows) and attributes (columns) Example: Consider the relation SOD(Starship, Objective, Destination) Starship Objective Destination Enterprise Exploration Talos Voyager Spying Mars Definition and need for MLS The relation in the example has no classification associated with it in a relational model The same example in MLS with
    [Show full text]
  • Multilevel Adaptive Security System
    Copyright Warning & Restrictions The copyright law of the United States (Title 17, United States Code) governs the making of photocopies or other reproductions of copyrighted material. Under certain conditions specified in the law, libraries and archives are authorized to furnish a photocopy or other reproduction. One of these specified conditions is that the photocopy or reproduction is not to be “used for any purpose other than private study, scholarship, or research.” If a, user makes a request for, or later uses, a photocopy or reproduction for purposes in excess of “fair use” that user may be liable for copyright infringement, This institution reserves the right to refuse to accept a copying order if, in its judgment, fulfillment of the order would involve violation of copyright law. Please Note: The author retains the copyright while the New Jersey Institute of Technology reserves the right to distribute this thesis or dissertation Printing note: If you do not wish to print this page, then select “Pages from: first page # to: last page #” on the print dialog screen The Van Houten library has removed some of the personal information and all signatures from the approval page and biographical sketches of theses and dissertations in order to protect the identity of NJIT graduates and faculty. ABSTRACT MULTILEVEL ADAPTIVE SECURITY SYSTEM by Hongwei Li Recent trends show increased demand for content-rich media such as images, videos and text in ad-hoc communication. Since such content often tends to be private, sensitive, or paid for, there exists a requirement for securing such information over resource constrained ad hoc networks.
    [Show full text]
  • Looking Back: Addendum
    Looking Back: Addendum David Elliott Bell Abstract business environment produced by Steve Walker’s Com- puter Security Initiative.3 The picture of computer and network security painted in What we needed then and what we need now are “self- my 2005 ACSAC paper was bleak. I learned at the con- less acts of security” that lead to strong, secure commercial ference that the situation is even bleaker than it seemed. products.4 Market-driven self-interest does not result in al- We connect our most sensitive networks to less-secure net- truistic product decisions. Commercial and government ac- works using low-security products, creating high-value tar- quisitions with tight deadlines are the wrong place to ex- gets that are extremely vulnerable to sophisticated attack or pect broad-reaching initiatives for the common good. Gov- subversion. Only systems of the highest security are suffi- ernment must champion selfless acts of security separately cient to thwart such attacks and subversions. The environ- from acquisitions. ment for commercial security products can be made healthy again. 3 NSA Has the Mission In 1981, the Computer Security Evaluation Center was 1 Introduction established at the National Security Agency (NSA). It was charged with publishing technical standards for evaluating In the preparation of a recent ACSAC paper [1], I con- trusted computer systems, with evaluating commercial and firmed my opinion that computer and network security is in GOTS products, and with maintaining an Evaluated Prod- sad shape. I also made the editorial decision to soft-pedal ucts List (EPL) of products successfully evaluated. NSA criticism of my alma mater, the National Security Agency.
    [Show full text]
  • A Logical Specification and Analysis for Selinux MLS Policy
    A Logical Specification and Analysis for SELinux MLS Policy BONIFACE HICKS St. Vincent College and SANDRA RUEDA, LUKE ST.CLAIR, TRENT JAEGER, and PATRICK MCDANIEL The Pennsylvania State University The SELinux mandatory access control (MAC) policy has recently added a multilevel security (MLS) model which is able to express a fine granularity of control over a subject’s access rights. The problem is that the richness of the SELinux MLS model makes it impractical to manually evaluate that a given policy meets certain specific properties. To address this issue, we have modeled the SELinux MLS model, using a logical specification and implemented that specification in the Prolog language. Furthermore, we have developed some analyses for testing information flow properties of a given policy as well as an algorithm to determine whether one policy is compliant with another. We have implemented these analyses in Prolog and compiled our implementation into a tool for SELinux MLS policy analysis, called PALMS. Using PALMS, we verified some important properties of the SELinux MLS reference policy, namely that it satisfies the simple security condition and - property defined by Bell and LaPadula. We also evaluated whether the policy associated to a given application is compliant with the policy of the SELinux system in which it would be deployed. Categories and Subject Descriptors: K.6.5 [Management of Computing and Information Sys- tems]: Security and Protection; D.4.6 [Operating Systems]: Security and Protection—Informa- tion flow controls General Terms: Security, Languages, Verification Additional Key Words and Phrases: SELinux, multilevel security, policy compliance, policy analysis ACM Reference Format: Hicks, B., Rueda, S., St.
    [Show full text]
  • Oracle Solaris Secure
    Oracle Solaris 10 Security Frequently Asked Questions (FAQ) Last updated 02/08/2013 3-What is Role-Based Access Control? The Oracle Solaris Role-Based Access Control (RBAC) framework enables administrators to assign specific access rights to programs and commands for each user, reducing the chance of administrative errors or malicious use of IT resources. User Rights Management is centrally managed to 1-How can I sandbox applications to prevent misbehavior reduce costs and increase flexibility. or hacked applications from impacting the system? 4-How does Role-Based Access Control differ from Oracle Solaris Process Rights Management, introduced in application sandboxing (Process Rights Management)? Oracle Solaris 10, gives system administrators the ability to limit and selectively enable applications so they gain access to Oracle Solaris RBAC software constrains a user's actions, and just enough system resources to perform their functions. This sandboxing (Process Rights Management) constrains a process' capability dramatically reduces the possibility of attack from a capabilities. poorly written application by eliminating inappropriate access to the system. Even if hackers gain access to an application's 5-Will customer applications need to be changed to use server, they are unable to increase operating privileges, which sandboxing? limits the opportunity to inject malicious code or otherwise damage data. No. Application security policies can be applied either in the source code with knowledge of the process rights framework 2-What sort of attacks or hacking can application or at runtime without the application being aware of that sandboxing prevent? framework. Because Process Rights Management puts limits on the rights 6-What is Oracle Solaris Secure Execution? of a process, regardless of the user associated with the running process, a hacker who gains control over an application is Oracle Solaris Secure Execution prevents modified or similarly restricted.
    [Show full text]
  • Security Pattern Validation and Recognition
    Security-Pattern Recognition and Validation Dissertation Submitted by Michaela Bunke on 12th December 2018 to the Universit¨atBremen Faculty of Mathematics and Computer Science in partial fulfillment of the requirements for the degree of Doktor der Ingenieurwissenschaften { Dr.-Ing. { Reviewed by Prof. Dr. Hans-J¨orgKreowski Universit¨atBremen, Germany and Dr. Karsten Sohr Universit¨atBremen, Germany In Memorial of Ilse Schlamilch Karl Schlamilch Manfred Friedrichs 21 November 1924 03 March 1927 29 August 1935 09 June 2017 19 June 2018 3 July 2017 ABSTRACT The increasing and diverse number of technologies that are connected to the Internet, such as distributed enterprise systems or small electronic devices like smartphones, brings the topic IT security to the foreground. We interact daily with these technologies and spend much trust on a well-established software development process. However, security vulnerabilities appear in software on all kinds of PC(- like) platforms, and more and more vulnerabilities are published, which compromise systems and their users. Thus, software has also to be modified due to changing requirements, bugs, and security flaws and software engineers must more and more face security issues during the software design; especially maintenance programmers must deal with such use cases after a software has been released. In the domain of software development, design patterns have been proposed as the best-known solutions for recurring problems in software design. Analogously, security patterns are best practices aiming at ensuring security. This thesis develops a deeper understanding of the nature of security patterns. It focuses on their validation and detection regarding the support of reviews and maintenance activities.
    [Show full text]
  • In Guards We Trust: Security and Privacy in Operating Systems Revisited
    SocialCom/PASSAT/BigData/EconCom/BioMedCom 2013 In Guards we trust: Security and Privacy in Operating Systems revisited Michael Hanspach Jorg¨ Keller Fraunhofer FKIE, Wachtberg, Germany FernUniversitat¨ in Hagen, Germany Email: [email protected] Email: [email protected] Abstract—With the rise of formally verified micro kernels, focus on the general system architecture and not on solutions we finally have a trusted platform for secure IPC and rigorous for solving our specific higher level security goals such as enforcement of our mandatory access control policy. But, not partitioning of shared resources or applications of input and every problem in computer security and privacy could possibly output filtering. Some of the middleware’s components would be solved by a trusted micro kernel, because we have higher have to be implemented as a trusted component, whereby level security and privacy concepts like packet filtering, data others could be implemented as untrusted components, because encryption and partitioning of shared hardware devices, which we also need to trust. Numerous authors have described the need their critical aspects could as well be checked or provided for a trusted middleware, fulfilling these higher level security and by a trusted component. Trusted components that provide privacy goals, but detailed requirements for the different security critical services to other components are known as guards and privacy goals are still missing. We provide a collection of (see also Section II). They are utilized in the context of a output filters that can be applied to trusted operating system component-based operating system, i.e. an operating system components to enforce higher level security goals.
    [Show full text]
  • Controlled Environment to Run Untrusted Applications
    CONTROLLED ENVIRONMENT TO RUN UNTRUSTED APPLICATIONS A thesis submitted To Kent State University in partial Fulfillment of the requirements for the Degree of Master of Science by TAHANI ALBALAWI August, 2013 Thesis written by TAHANI ALBALAWI B.S., Taiba University, KSA 2007 M.S., Kent State University, USA, 2013 Approved by Michael Rothstein, Advisor Javed Khan , Chair, Department of Computer Science Raymond Craig, Dean, College of Arts and Sciences ii Abstract Untrusted applications pose a security threat to systems they run on. At the same time sometimes a user wants to run such applications without risking unauthorized access to certain parts of the system. For this reason we propose a controlled environment to run host untrusted applications based on AppArmor tool. We intend to augment the usefulness of AppArmor by further restricting the permissions of the files accessible to the process using other system mechanisms, such as NFS and Chroot. Based on the principle of least authority, programs can run in a restricted secure environment limiting access to a subset of the files. This way untrusted applications are allowed to run with limits to protect the system. iii Table of Contents LIST OF FIGURES ..................................................................................................... vii LIST OF TABLES ...................................................................................................... vii DEDICATION.............................................................................................................
    [Show full text]
  • Flexible and Fine-Grained Mandatory Access Control on Android For
    Flexible and Fine-grained Mandatory Access Control on Android for Diverse Security and Privacy Policies Sven Bugiel, Saarland University; Stephan Heuser, Fraunhofer SIT; Ahmad-Reza Sadeghi, Technische Universität Darmstadt and Center for Advanced Security Research Darmstadt This paper is included in the Proceedings of the 22nd USENIX Security Symposium. August 14–16, 2013 • Washington, D.C., USA ISBN 978-1-931971-03-4 Open access to the Proceedings of the 22nd USENIX Security Symposium is sponsored by USENIX Flexible and Fine-Grained Mandatory Access Control on Android for Diverse Security and Privacy Policies Sven Bugiel Stephan Heuser [email protected]∗ [email protected] Saarland University, Germany Fraunhofer SIT, Germany Ahmad-Reza Sadeghi [email protected] Technische Universität Darmstadt / CASED, Germany Abstract Android’s vulnerabilities. Android has been shown to be vulnerable to a number of different In this paper we tackle the challenge of providing attacks such as malicious apps and libraries that mis- a generic security architecture for the Android OS use their privileges [57, 40, 25] or even utilize root- that can serve as a flexible and effective ecosystem exploits [55, 40] to extract security and privacy sen- to instantiate different security solutions. In con- sitive information; taking advantage of unprotected trast to prior work our security architecture, termed interfaces [14, 12, 53, 32] and files [49]; confused FlaskDroid, provides mandatory access control si- deputy attacks [16]; and collusion attacks [46, 34]. multaneously on both Android’s middleware and kernel layers. The alignment of policy enforcement Solutions. On the other hand, Android’s open- on these two layers is non-trivial due to their com- source nature has made it very appealing to academic pletely different semantics.
    [Show full text]
  • Toward Multiple Level Security Cloud with Strong Hardware Level Isolation
    MUSHI: Toward Multiple Level Security Cloud with Strong Hardware Level Isolation Ning Zhang∗ Ming Li† Wenjing Lou∗ Y. Thomas Hou∗ ∗Complex Network and Security Research Laboratory, College of Engineering, Virginia Tech, VA †Department of Computer Science, Utah State University, Logan, UT Abstract—Multiple Level Security (MLS) has always been a agement servers with vulnerabilities in [8], [9], [12]. Lastly, center of focus since the usage of computers in military and adversaries might even use social engineering to compromise intelligence systems. Extensive studies have been done on how accounts of the management personnel. Given the advanced to utilize virtualization technologies to provide multiple level secured execution in the cloud, yet the general assumption is that persistent threats faced by the military today, it is unrealistic all components in the cloud service provider are trusted. With to assume the cloud infrastructure can be secured against the advanced persistent threats currently faced by the military various types of malicious activity including social engineering and intelligence community, it is unrealistic to assume complex at all time. To address this challenge, we proposed MUSHI, information systems can remain trustworthy all the time. In a hardware level isolated parallel execution environment to this work, we present MUltiple level Security cloud with strong Hardware level Isolation (MUSHI), a novel framework that can enable secured operations in the presence of both malicious provide hardware level isolation and protection to individual cloud host and collocated malicious VMs. Specifically MUSHI guest virtual machine (VM) execution. With MUSHI, a user can has the following unique attributes maintain confidentiality and integrity of her VM in a multicore • environment even in the presence of malicious attacks from both Our system does not rely on a secured cloud infrastruc- within and outside the cloud infrastructure.
    [Show full text]