Enhanced Security for Cloud Computing

Wednesday, October 5, 2011 @ 02:10 PM gHale


There is a new way to better protect sensitive information in cloud computing without significantly affecting the system’s overall performance.

Under the cloud-computing paradigm, the computational power and storage of multiple computers pools, and multiple users can share it. Hypervisors are programs that create the virtual workspace that allows different operating systems to run in isolation from one another – even though each of these systems is using computing power and storage capability on the same computer.

RELATED STORIES
Securing Automobile Software Updates
Wireless Sensors Collect Water Data
Cell Phone Chemical Detector
Wireless Report: Bluetooth Easy to Exploit

A longstanding concern in cloud computing is attackers could take advantage of vulnerabilities in a hypervisor to steal or corrupt confidential data from other users in the cloud.

There is a new approach to cloud security in development that builds upon existing hardware and firmware functionality to isolate sensitive information and workload from the rest of the functions performed by a hypervisor.

The new technique, called “Strongly Isolated Computing Environment” (SICE), demonstrates the introduction of a different layer of protection.

“We have significantly reduced the ‘surface’ that can be attacked by malicious software,” says Dr. Peng Ning, a professor of computer science at North Carolina State University and co-author of a paper describing the research. “For example, our approach relies on a software foundation called the Trusted Computing Base, or TCB, that has approximately 300 lines of code, meaning that only these 300 lines of code need to be trusted in order to ensure the isolation offered by our approach. Previous techniques have exposed thousands of lines of code to potential attacks. We have a smaller attack surface to protect.”

SICE also lets programmers dedicate specific cores on widely-available multi-core processors to the sensitive workload – allowing the other cores to perform all other functions normally.

A core is the brain of a computer chip, and computers now use chips that have between two and eight cores. By confining the sensitive workload to one or a few cores with strong isolation, and allowing other functions to operate separately, SICE is able to provide high assurance for the sensitive workload and efficient resource sharing in a cloud.

In testing, the SICE framework generally took up approximately 3 percent of the system’s performance overhead on multi-core processors for workloads that do not require direct network access. “That is a fairly modest price to pay for the enhanced security,” Ning said. “However, more research is needed to further speed up the workloads that require interactions with the network.”



Leave a Reply

You must be logged in to post a comment.