KVM and security: Protecting users in the cloud

CLOUD USERS and providers everywhere are faced with common questions – how best to make sure that workloads in the cloud are secure and that private data stays private.

One key technology decision in making clouds secure is which hypervisor to choose, and it is here that we believe that KVM offers a better solution. KVM is a Type 1 hypervisor, based on Linux, which inherits the underlying strengths and capabilities of Linux. Through its use of SELinux and Mandatory Access Control, KVM integrates advanced security at the heart of the hypervisor, providing sandbox isolation between data, applications and users in both private and public clouds.
There are many security issues that cloud providers need to address in order to reassure users and enterprises that the cloud is secure, including:

 Application Isolation – are applications
protected from each other, especially
malicious or malfunctioning applications

 Data protection – is one user’s data
protected from other users and their
applications, unless access has been
specifically granted

 Access control – are users authenticated
securely, to prove who they say they are
and validate what data and applications
they can access
 Manageability – can the security
permissions and access control be easily
and securely managed

 Certification – has the security of the
system been evaluated, and has the
software itself been methodically
designed, tested and reviewed

KVM addresses these and other security
issues in the following ways:

 Discretionary Access Control - KVM
processes inherit the standard security
and access controls of Linux, with virtual
machines running as Linux processes.
This includes separation of user and
kernel space, and Discretionary Access
Control enables users to allow others
users access to their data and resources.
DAC is included in all the major
hypervisors.

 Mandatory Access Control - Mandatory
Access Control is a more advanced level
of security, which was originally
implemented in military-grade systems.
With MAC, users are only allowed to
access the resources they have been
specifically authorized to access by the
administrator. SELinux, which implements
MAC, was developed by the US National
Security Agency as open source code,
and was included in the Linux kernel
over 10 years ago. sVirt combines
SELinux with KVM to deliver Mandatory
Access Control for virtual machines – so
ensuring that applications running under
KVM can only access resources outside
their virtual machine which they have
specifically been authorized to access. sVirt uses libvirt to implement Mandatory Access Control without requiring configuration by the user. KVM is the only hypervisor to implement MAC by default.

 Hardware-based Isolation - leveraging
the virtualization-specific processor
instructions of Intel® Virtualization
Technology (Intel® VT) and AMD’s
Secure Virtual Machine (SVM) enables
KVM to protect itself from applications
running inside a virtual machine. Any
attempt by a guest virtual machine to
subvert the hypervisor security protection
by executing a privileged instruction will
transfer control to the hypervisor which
can then take evasive action. Hardware-
based isolation is available to all the
major hypervisors that use the Intel or
AMD virtualization extensions.

 Open Source Code - concerns about
whether “back doors” have been included
in systems software are allayed by open
source software, since the source code
is publically available and can be
inspected by anyone. This includes
both the hypervisor code of KVM and the
Mandatory Access Control code of SE
Linux. KVM and other open source
hypervisors therefore have the advantage
of security by openness, as well as the
high quality delivered by the peer review
process of open source development.

 Certification - to help governments and
other organizations be assured that
software has been reliably designed
and tested for security, the Common
Criteria framework has been developed.
This includes a certification scheme which
evaluates security of systems at a number
of Evaluation Assurance Levels. EAL4
is the level which assures that the systems
software has been methodically designed,
tested and reviewed. KVM has achieved
EAL4+ certification for a number of
specific configurations, including Red
Hat Enterprise Linux running on HP and
IBM servers using Intel processors.
The combination of all these security
features in KVM lead to it offering advanced security for the following use cases:

 Linux servers – protecting applications
from each other, enabling multiple
workloads to be consolidated
onto a single server while
retaining the application isolation of
separate physical servers
 Cloud computing – protecting users and
their data and applications from
each other, including in a multi-tenant
environment, so enabling resources to
be shared, costs to be reduced, and
virtual machines provisioned on demand

 Desktop virtualization – protecting user
sessions and data from each other,
including both Windows and Linux
applications, and enabling the separation
of data owned by different enterprises on
the same laptop computers

 Government and financial systems –
ensuring Mandatory Access Control is
implemented between applications and
providing military-grade security to
sandbox data

KVM continues to be enhanced and developed, including porting it to other processor architectures such as ARM and POWER, and improving the virtualization management tools available through oVirt, OpenStack and related products.

KVM, with its virtualization of the complete virtual machine, also currently provides a higher level of security and protection than Linux containers and Docker, which virtualize just the application and environment. There is in fact strong support for deploying containers within virtualized environments because of the security advantage provided by KVM, while retaining the ease of deployment benefits of Docker.

For today’s servers and clouds, where the highest level of security is needed, KVM offers a powerful enterprise solution.

For more information about the Open Virtualization Alliance and its mission to increase the awareness and adoption of KVM, visit https://openvirtualizationalliance.org
For a more detailed discussion of KVM Security, download the IBM whitepaper “KVM: Hypervisor Security You Can Depend On” from ftp://public.dhe.ibm.com/linux/pdfs/LXW03004-USEN-00.pdf