Secure Offloading of Intrusion Detection Systems from VMs with Intel SGX
This paper discusses the secure offloading of Intrusion Detection Systems from Virtual Machines using Intel SGX technology. It explores the potential benefits and challenges of implementing this approach, highlighting the research conducted at Kyushu Institute of Technology in Japan.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Secure Offloading of Intrusion Detection Systems from VMs with Intel SGX Tomoharu Nakano and Kenichi Kourai Kyushu Institute of Technology, Japan
2 IDS Offloading Intrusion detection systems (IDS) are needed in clouds Some of the virtual machines (VMs) have vulnerabilities Host-based IDS running in VMs can be easily disabled by intruders IDS can be securely offloaded to the outside of VMs Monitor OS data by analyzing VMs' memory Inspect files by analyzing VMs' disks target VM VM introspection attacker IDS virtual disk OS
3 Attacks against Offloaded IDS Offloaded IDS can be still attacked Usually run in privileged VMs (Xen) or as host processes (KVM) The full-fledged OS has many vulnerabilities Difficult to protect offloaded IDS from attackers Steal sensitive information from the memory of offloaded IDS Intrude into the target VM after disabling offloaded IDS management VM target VM VMI IDS attacker OS
4 Previous Approaches (1/2) Offload IDS to more secure VMs [Butt+, CCS'12] Even system admins cannot access secure VMs Such VMs are still vulnerable due to rich execution environments Embed IDS into the hypervisor [Oyama+, SAC'12] ... Increase the attack surfaces of the hypervisor Provide only a poor execution environment for the hypervisor secure VM VMI target VM IDS OS attacker hypervisor IDS
5 Previous Approaches (2/2) Run IDS below the target system [Miyama+, ESORICS'17] ... Confine the target system to a VM using nested virtualization Largely degrade the performance of target VMs Offload IDS to hosts outside clouds [Kourai+, CLOUD'16] Need trusted remote hosts to run offloaded IDS Costly to transfer a VM's data from clouds to remote hosts VMI target VM IDS IDS cloud remote host hypervisor outer VM
6 Our Approach: SGmonitor Securely offload IDS using Intel SGX in clouds Run IDS in protection domains called enclaves Provide a small library for a rich execution environment to IDS Not affect the security or performance of the entire system Threat model Trust CPUs and the hypervisor Untrust the other software SGX application enclave VMI target VM IDS runtime library hypervisor cloud
7 Secure Execution of In-enclave IDS SGX guarantees confidentiality by memory encryption Protect sensitive information in the memory of in-enclave IDS SGX guarantees integrity by memory integrity checks Prevent attackers from disabling functions by tampering with IDS SGmonitor confirms the behavior by secure heartbeat Periodically send a challenge and check its response at a user's host enclave secure heartbeat IDS library attacker user's host cloud
8 Secure Memory Introspection Enable in-enclave IDS to monitor a VM's memory IDS invokes the runtime outside the enclave via the library The runtime invokes the hypervisor to obtain OS data in the VM Provide its own data protection for memory introspection Encrypt memory data in the hypervisor and decrypt it in the library Calculate its hash value in the hypervisor and check it in the library target VM enclave IDS runtime OS library memory data hypervisor
9 Secure Storage Introspection Provide the in-enclave filesystem to monitor a VM's disk IDS invokes the filesystem to read files and directories The filesystem invokes the runtime at the block-level interface The runtime reads specified blocks from the virtual disk Protect data by using encrypted virtual disks Obtain encrypted block data and decrypt it in the library target VM enclave block data IDS virtual disk runtime filesystem hypervisor
10 Rich but Minimum Execution Environment Provide the in-kernel API to in-enclave IDS Allow using kernel data structure, macros, and inline functions Develop IDS like OS kernel modules Bridge the gap between it and low-level memory data Transform IDS code at compile time Transparently perform memory introspection on OS data access IDS code SGmonitor compiler task = task->next IDS task = vmread(&task->next) OS code
11 Secure Key Exchange Securely share an encryption key with the hypervisor The library encrypts the key using the hypervisor's public key The hypervisor decrypts the key using its private key Prevent attackers from sharing a key to obtain a VM's data Perform the remote attestation of a created enclave by a user's host Verify the digital signature done by the host in the hypervisor user's host enclave IDS runtime encryption key public key remote attestation library user's private key user's public key private key hypervisor
12 Experiments Develop chkrootkit-like in-enclave IDS Detect 9 malware by memory introspection Detect 57 malware by storage introspection Code size: only 396 KB We examined its effectiveness Compared with the traditional IDS offloading Compared with SGmonitor without its own data protection others 5% filesystem 13% IDS 38% regex 27% SDK 11% AES 6% CPU: Intel Xeon E3-1225 v5 Memory: 8 GB HDD: 1 TB Virtualization: Xen-SGX 4.7 VM: 2 vCPUs, 2 GB memory, 50 GB disk, Linux 4.4
13 Effectiveness of In-enclave IDS In-enclave IDS could detect various types of malware kworkerds process and adore kernel module Network connection to port 2001 used by Scalper worm /etc/xig file created by Rocke Monoro Miner We used Metasploitable 2 including various real backdoors In-enclave IDS could detect a backdoor for inetd
14 Performance of Secure VMI We measured the throughput of memory introspection SGmonitor degraded it by 76% mainly due to its own data protection We measured the throughput of storage introspection SGmonitor degraded it by 76% due to SGX 350 2.5 Memory introspection Storage introspection 300 2.0 throughput (MB/s) throughput (GB/s) 250 1.5 200 150 1.0 100 0.5 50 0 0.0 traditional SGmonitor/noprot SGmonitor traditional SGmonitor/noprot SGmonitor
15 Performance of In-enclave IDS We measured the execution time of in-enclave IDS The overhead by SGmonitor was 31% 74% longer in memory-related detection like microbenchmark Only 17% longer in storage-related detection String pattern matching took a long time 800 20 execution time obtained data execution time (ms) 600 15 data size (MB) 400 10 200 5 0 0 traditional SGmonitor/noprot SGmonitor storage memory memory storage
16 Conclusion We proposed SGmonitor for the secure execution of offloaded IDS with SGX Securely run IDS in SGX enclaves created inside clouds Minimize the impact on the security/performance of the system Provide the in-kernel API for a rich execution environment The performance overhead of in-enclave IDS was 31% Future work Provide the user-space API, e.g., using SCONE [Arnautov+, OSDI'16] Use System Management Mode (SMM) to obtain memory data
