Automating Security Audits of Heterogeneous Virtual Infrastructures

The use of server virtualization has steadily been growing - but many enterprises are still reluctant to migrate critical workloads to such private cloud infrastructures. One critical inhibitor is the complexity of correctly configuring virtualization technology to implement enterprise security policies, such as isolation of workloads or customers, across all potentially shared physical and virtual resources. To mitigate these concerns, this article describes a virtual infrastructure validation and assurance system for a heterogeneous datacenter. It supports different types of server hardware and virtual machine monitors as well as both virtual and non-virtual resources, such as networking and storage. We use customer isolation as a running example to illustrate our approach to validating configurations. We focus on virtual infrastructures and provide a detailed view on internal resource allocations and configurations. We demonstrate the utility of our framework through evaluation and visualization of information flow graphs that are used to validate customer isolation. Our system discovers the actual configuration of the virtualization infrastructure (Xen, VMware, KVM, and IBM's PowerVM) and unifies the configuration data into a joint generic data model. This data model is then used to derive a data flow graph that allows us to automatically determine whether two subscribers share any resources that are not trusted in order to achieve proper isolation.

By: S. Bleikertz, T. Gross, M. Schunter, K. Eriksson

Published in: RZ3786 in 2010


This Research Report is available. This report has been submitted for publication outside of IBM and will probably be copyrighted if accepted for publication. It has been issued as a Research Report for early dissemination of its contents. In view of the transfer of copyright to the outside publisher, its distribution outside of IBM prior to publication should be limited to peer communications and specific requests. After outside publication, requests should be filled only by reprints or legally obtained copies of the article (e.g., payment of royalties). I have read and understand this notice and am a member of the scientific community outside or inside of IBM seeking a single copy only.


Questions about this service can be mailed to .