Automated Information Flow Analysis of Virtualized Infrastructures

  • Sören Bleikertz
  • Thomas Groß
  • Matthias Schunter
  • Konrad Eriksson
Conference paper

DOI: 10.1007/978-3-642-23822-2_22

Part of the Lecture Notes in Computer Science book series (LNCS, volume 6879)
Cite this paper as:
Bleikertz S., Groß T., Schunter M., Eriksson K. (2011) Automated Information Flow Analysis of Virtualized Infrastructures. In: Atluri V., Diaz C. (eds) Computer Security – ESORICS 2011. ESORICS 2011. Lecture Notes in Computer Science, vol 6879. Springer, Berlin, Heidelberg

Abstract

The use of server virtualization has been growing steadily, but many enterprises still are reluctant to migrate critical workloads to such infrastructures. One key inhibitor is the complexity of correctly configuring virtualized infrastructures, and in particular, of isolating workloads or subscribers across all potentially shared physical and virtual resources. Imagine analyzing systems with half a dozen virtualization platforms, thousands of virtual machines and hundreds of thousands of inter-resource connections by hand: large topologies demand tool support.

We study the automated information flow analysis of heterogeneous virtualized infrastructures. We propose an analysis system that performs a static information flow analysis based on graph traversal. The system discovers the actual configurations of diverse virtualization environments and unifies them in a graph representation. It computes the transitive closure of information flow and isolation rules over the graph and diagnoses isolation breaches from that. The system effectively reduces the analysis complexity for humans from checking the entire infrastructure to checking a few well-designed trust rules on components’ information flow.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Sören Bleikertz
    • 1
  • Thomas Groß
    • 1
  • Matthias Schunter
    • 1
  • Konrad Eriksson
    • 2
  1. 1.IBM Research - Zurich
  2. 2.InfraSight Labs

Personalised recommendations