Secure Offloading of Intrusion Detection Systems from VMs with Intel SGX
Secure Offloading of Intrusion Detection Systems from VMs with Intel SGX
复制标题
DOI：
10.1109/cloud53861.2021.00043
复制
发表时间：
2021-09
期刊：
影响因子：
--
通讯作者：
Tomoharu Nakano;Kenichi Kourai
中科院分区：
文献类型：
--
作者：
Tomoharu Nakano;Kenichi Kourai
云中的虚拟机（VM）需要使用入侵检测系统（IDS）进行监控。由于基于主机的IDS很容易被入侵者禁用，因此使用VM内省（VMI）的IDS卸载来安全地在目标VM之外运行IDS。但是，卸载的IDS仍然可能受到攻击，因为它运行在易受攻击的操作系统（OS）之上。已经提出了各种系统来保护卸载的IDS，但是没有系统为IDS提供合适的执行环境。本文提出了SGmonitor，用于支持使用英特尔SGX安全执行从云中VM卸载的IDS。SGmonitor在SGX安全区中执行IDS，并保持机密性和完整性。它通过使用加密和完整性检查为内存和存储提供安全的VMI。为了简化卸载IDS的开发，它为飞地内IDS提供了内核内API，并支持对VM中操作系统数据的透明访问。我们已经在Xen中实现了SGmonitor，支持SGX，并表明in-enclave IDS的开销为31%，以补偿更强的安全性。
Virtual machines (VMs) inside clouds need to be monitored using intrusion detection systems (IDS). Since host-based IDS can be easily disabled by intruders, IDS offloading with VM introspection (VMI) is used to securely run IDS outside a target VM. However, offloaded IDS can be still attacked because it runs on top of a vulnerable operating system (OS). Various systems have been proposed to protect offloaded IDS, but no systems provide an appropriate execution environment to IDS. This paper proposes SGmonitor for enabling the secure execution of IDS offloaded from VMs inside clouds using Intel SGX. SGmonitor executes IDS in SGX enclaves and preserves confidentiality and integrity. It provides secure VMI for memory and storage by using encryption and integrity checking. To make the development of offloaded IDS easier, it provides the in-kernel API to in-enclave IDS and enables transparent access to OS data in VMs. We have implemented SGmonitor in Xen with SGX support and showed that the overhead of in-enclave IDS was 31% in compensation for much stronger security.