ACCESS ISOLATION MECHANISM BASED ON VIRTUAL CONNECTION MANAGEMENT IN CLOUD SYSTEMS How to Secure Cloud System using High Perfomance Virtual Firewalls Alexey Lukashin, Vladimir Zaborovsky and Sergey Kupreenko Saint-Peterburg State Polytechnical University, Polytechnicheskaya street 29, Saint-Petersburg, Russia Keywords: Security, Firewall, Cloud system, Virtualization, Virtual connection. Abstract: The paper describes the access isolation model based on virtual connection management and proposes the mechanism of traffic filtering in transparent mode, invisible to other components. New level of complexity of information security tasks was observed in the distributed virtualized systems. The paper proposes a specialized firewall solution for implementing access isolation and information security in hypervisors and entire distributed cloud system. 1 INTRODUCTION current information security tasks, and would be scalable and adaptable to different situations. The Virtualization of distributed computational resources paper highlights the promising (perspective) and development of heterogeneous virtual machine approaches to information protection in the environments are a very popular and fast growing distributed computing environments. These area in information technologies. Various approaches use the high-performance virtual components belonging to this area are usually firewalls, that operate in stealth mode in the denoted by the term “cloud computing”. A lot of virtualization nodes of the computing environment service providers offer such solutions, from IaaS to and provide consistency of security policies through SaaS layers. There are not only public cloud a centralized management. Applying the methods of providers such as Amazon, Google, and others. formalizing security to automate the generation of Private clouds are becoming very popular and there filtering rules in combination with hardware and are a lot of solutions based on Eucalyptus, Open software platforms based on multicore Nebula, VmWare, or Microsoft technologies. microprocessors can deliver high performance Therefore, ensuring information security of cloud firewall. This firewall implements the filtering systems is a vital problem (Cloud Security Alliance, functions in the operating system kernel based on 2010). The present paper introduces a virtual the application network management models in the connection as an emergence essence and describes Netgraph subsystem. the access isolation in virtual networks based on the virtual connection management. The network traffic is described as an aggregation of virtual connections. 2 INFORMATION SECURITY IN The distributed virtual environment (cloud system) CLOUD SYSTEMS provides heterogeneous computing resources; therefore, it would be reasonable to use these Today, many companies, including leading resources to protect the information security of the universities and government institutions, are system. Virtual connections function separately of transferring their computing resources to the virtual each other and do not have any shared resources, so infrastructures, using both open systems it is possible to establish parallel traffic filtering (Eucalyptus, Open Nebula) and commercial within the security domain. This security domain solutions (VmWare, Citrix, IBM). Due to this trend, would exist in the hypervisor, would use the amount the information security of cloud systems becomes of resources (cores, memory) that is required for an acute problem. The major differences between Lukashin A., Zaborovsky V. and Kupreenko S.. ACCESS ISOLATION MECHANISM BASED ON VIRTUAL CONNECTION MANAGEMENT IN CLOUD SYSTEMS - How to Secure Cloud System using 371 High Perfomance Virtual Firewalls. DOI: 10.5220/0003433803710375 In Proceedings of the 13th International Conference on Enterprise Information Systems (ICEIS-2011), pages 371-375 ISBN: 978-989-8425-55-3 Copyright c 2011 SCITEPRESS (Science and Technology Publications, Lda.) ICEIS 2011 - 13th International Conference on Enterprise Information Systems the cloud systems and the distributed networks are compatibility with the interfaces of Amazon the following: (Amazon EC2, Amazon S3) products. o Information processing takes place on the virtual machines under full hypervisor’s control; the hypervisor has access to all data processed by 3 VIRTUAL CONNECTION its virtual machines; o Cloud software controls the resource planning MANAGEMENT IN THE and provision; it is a new entity in the information ACCESS CONTROL TASKS environment which has to be protected from the information security threats; Virtual connection (VC) is a logically ordered o Traditional information security components exchange of messages between the network nodes. such as hardware firewalls cannot control the (Silinenko, 2009). Computer network is a set of internal virtual traffic between virtual machines in virtual connections. Virtual connections are one hypervisor; classified as technological virtual connections o In virtualized environments, files serve as (TVC) and information virtual connections (IVC). virtual storage devices; these files are located in (Figure 1). the network storages and are more exposed to threats than hard disks; o Transfer of instance memory occurs when migrating virtual machines between hypervisors; this memory may contain confidential information. Therefore, due to the above-listed specifics, new information security threats appear, including: o Attacks against the virtual machines management tools, controllers of the computing environment (cloud controller), or cluster and data Figure 1: Layers of access control policies. storage, where the virtual machine images and user data are located; To implement the policy of access control, the o Unauthorized access to the virtualization node; filtering rules are decomposed in the form of TVC o Using virtual network for data transfer not and the IVC. These filtering rules can be configured allowed by the information security policy. for different levels of data flows description based The major specifics of the virtual infrastructure on the network packet fields on the levels of is that an attack or an attempt of unauthorized access channel, transport, and application protocols. In can come from the virtual network, where such terms of the access control, the TVC model can be devices as switches, hardware firewalls, and defined as a stream of packets generated by the physical connections are absent. This specifics network applications during communication. The hampers applying the exiting methods and tools for TVC model is presented in the form of potentially ensuring information security in computer networks countable subset of the Cartesian product set of and GRID systems to the information security packets P and timestamp T (1). protection of cloud systems. The distributed and virtual computing environments TVC={pti},i =1, N, N ∈[1,∞) ⊂ P×T (1) do not have effective methods of information security protection. One of the problems is the lack This model is characterized by a finite set of of firewalls, which can operate in virtual parameters that describes the access subject and the environment as efficiently as the existing on the access object, as well as action between them in the market software and hardware solutions for form of packet stream within the interconnection. protection of information resources and reflection of The model parameters are the identifiers of the cyber attacks. For a number of cloud solutions, for subject and the object, such as addresses, ports, and example, free and open source cloud environment other characteristics of network protocols. For Eucalyptus, based on hypervisors XEN or KVM, efficient traffic classification, the IVC model is used there are no efficient solutions for the virtual along with the TVC model. The IVC model machines’ protection, despite of the rapidly growing describes the interaction between the access object popularity of this environment due to its and the access subject at the application services 372 ACCESS ISOLATION MECHANISM BASED ON VIRTUAL CONNECTION MANAGEMENT IN CLOUD SYSTEMS - How to Secure Cloud System using High Perfomance Virtual Firewalls level. The IVC model is a set of technical virtual or not, the decision is postponed and VC is connections (TVC); the number and characteristics temporarily allowed. of these TVCs are determined by the Cartesian Computing problems could be divided into two product of the information interaction access model groups: (IIM), the access subject model (IMS), and the 1. Stream-related tasks that can be calculated with access object model(IMO) (2). SIMD processing elements (for example, using graphic processors and CUDA technology). (2) IVC = {TVCi},i = 1, N ⊂ (IIM × IMS × IMO) 2. Computational problems solved on the standard This formalization allows representing the access multicore computers MIMD. IIM as a finite subset. The size of this subset is Because the distributed environment is determined based on the description of heterogeneous with respect to the available interconnection subjects permitted within the given processing elements, both the streaming SIMD access control policy. IMO is characterized by a processors and the classic MIMD multicore finite subset of information and network resources, processors can be used for the firewall tasks in the the access to which is This formalization allows cloud systems. Firewalls that protect the hypervisor representing the access IIM as a finite subset. The operate in the virtualized environment;