GERIS '16 March 7, 8, and 9, 2016 Binghamton University, Binghamton, NY
Abstract: Privacy-preserving Virtual Machines
Cloud computing systems routinely process users’ confidential data, but the underlying virtualization software in use today is not constructed to minimize the exposure of such data. For instance, virtual machine (VM) checkpointing can drastically prolong the lifetime and vulnerability of confidential data without users’ knowledge by storing such data as part of a persistent snapshot. A key requirement for minimizing the exposure of any data is the ability to cleanly isolate such data for either exclusion or processing. Traditional mechanisms for memory taint tracking are expensive whereas those for isolating application footprint in VM-based sandboxes are not transparent. We propose a transparent and lightweight mechanism for isolating a confidential applica- tion’s memory footprint in a VM. The key idea is for a parent VM to spawn a child VM, called a Privacy-preserving Virtual Machine (PPVM) within which the confidential application executes. Hypervisor features, such as VM checkpointing, that need to exclude the memory of a confidential application can safely ignore the child VM’s memory footprint. Alternatively, features such as checkpoint encryption or malware tracking can operate only on the child VM’s memory. We implement memory isolation for PPVM through a lightweight VM fork operation that uses copy-on-write to reduce the memory and filesystem overhead of the PPVM. Transparency is achieved through a confidential shell that allows the parent VM to spawn the confidential application in the PPVM and exercise control over it during runtime. We demonstrate the effectiveness of PPVM through its use with a standard hypervisor service, VM checkpointing, which can safely checkpoint the parent VM while excluding or encrypting the associated PPVM. We show that our PPVM implementation achieves effective memory isolation with low overheads on memory, CPU, and network performance.
Dr. Kartik Gopalan is an Associate Professor in Computer Science at the State University of New York at Binghamton. His research interests are in experimental computer systems, including Virtualization, Security, Distributed Systems, Operating Systems, and Networks. He received Ph.D. in Computer Science from Stony Brook University, M.S. in Computer Science from Indian Institute of Technology, Chennai, and B.E. in Computer Engineering from Delhi Institute of Technology. He directs the Operating Systems and Networks (OSNET) Group at Binghamton. Dr. Gopalan is a recipient of the National Science Foundation CAREER Award. Before joining Binghamton University, he was an Assistant Professor in Computer Science at Florida State University, Lead Architect and Developer at Rether Networks Inc., and Senior Software Engineer at Wipro Global R&D, Bangalore.