Login | Register

TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation


TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation

Wang, Yushun (2017) TenantGuard: Scalable Runtime Verification of Cloud-Wide VM-Level Network Isolation. Masters thesis, Concordia University.

Text (application/pdf)
Tenantguard.pdf - Accepted Version


The multi-tenancy of a cloud usually leads to security concerns over network isolation around each cloud tenant's virtual resources. However, verifying network isolation in cloud virtual networks poses several unique challenges. The
sheer size of virtual networks implies a prohibitive complexity, whereas the constant changes in virtual resources demand a short response time. To make things worse, such networks typically allow fine-grained (e.g., VM-level) and distributed (e.g., security groups) network access control. Those challenges can either invalidate existing approaches or cause an unacceptable delay which prevents runtime applications. In this thesis, we present TenantGuard, a scalable system for verifying cloud-wide, VM-level network isolation at runtime. We take advantage of the hierarchical nature of virtual networks, efficient data structures, incremental verification, and parallel computation to reduce the
performance overhead of security verification. We implement our approach based on OpenStack and evaluate its performance both in-house and on Amazon EC2, which confirms its scalability and efficiency (13 seconds for verifying 168 millions of VM pairs). We further integrate TenantGuard with Congress, an OpenStack
policy service, to verify the compliance of isolation results against
tenant-specific high level security policies.

Divisions:Concordia University > Gina Cody School of Engineering and Computer Science > Concordia Institute for Information Systems Engineering
Item Type:Thesis (Masters)
Authors:Wang, Yushun
Institution:Concordia University
Degree Name:M.A. Sc.
Program:Information Systems Security
Date:1 May 2017
Thesis Supervisor(s):Debbabi, Mourad and Lingyu, Wang
ID Code:982513
Deposited By: YU SHUN WANG
Deposited On:09 Jun 2017 14:38
Last Modified:18 Jan 2018 17:55
All items in Spectrum are protected by copyright, with all rights reserved. The use of items is governed by Spectrum's terms of access.

Repository Staff Only: item control page

Downloads per month over past year

Back to top Back to top