Formal verification of security preservation for migrating virtual machines in the cloud

Authors:
Yosr Jarraya;Arash Eghtesadi;Mourad Debbabi;Ying Zhang;Makan Pourzandi
Affiliations:
Computer Security Laboratory, CIISE, Concordia University, Montreal, Quebec, Canada;Computer Security Laboratory, CIISE, Concordia University, Montreal, Quebec, Canada;Computer Security Laboratory, CIISE, Concordia University, Montreal, Quebec, Canada;Sillicon Valley Lab, Ericsson Research, San Jose, CA;Ericsson Research Canada, Montreal, Quebec, Canada
Venue:
SSS'12 Proceedings of the 14th international conference on Stabilization, Safety, and Security of Distributed Systems
Year:
2012

Citing 6
Cited 0

Mobile ambients

Theoretical Computer Science
FIREMAN: A Toolkit for FIREwall Modeling and ANalysis

SP '06 Proceedings of the 2006 IEEE Symposium on Security and Privacy
Handbook of Knowledge Representation

Handbook of Knowledge Representation
Model Checking Firewall Policy Configurations

POLICY '09 Proceedings of the 2009 IEEE International Symposium on Policies for Distributed Systems and Networks
Communication and mobility control in boxed ambients

Information and Computation
Automatic Conformance Verification of Distributed Firewalls to Security Requirements

SOCIALCOM '10 Proceedings of the 2010 IEEE Second International Conference on Social Computing

Quantified Score

Hi-index	0.00

Visualization

Abstract

Firewalls are a prerequisite for securing any communication network. In cloud computing environments, virtual machines are dynamically and frequently migrated across data centers. This frequent modification in the topology requires frequent reconfiguration of security appliances, particularly firewalls. In this paper, we address the issue of security policy preservation in a distributed firewall configuration within a highly dynamic context. Thus, we propose a systematic procedure to verify security compliance of firewall policies after VM migration. First, the distributed firewall configurations in the involved data centers are defined according to the network topology expressed using Cloud Calculus. Then, these configurations are expressed as propositional constraints and used to build a verification model based on the constraint satisfaction problem framework, which allows reasoning on security policy preservation. Finally, we present a case study inspired from Amazon EC2 to show the applicability and usefulness of our approach.