Newswise – New York, NY — May 24, 2021 — Every time you buy something from Amazon, your customer data is automatically updated and stored on thousands of virtual machines in the cloud. For companies like Amazon, ensuring the safety and security of the data of its millions of customers is essential. This is true for large and small organizations. But until now, there was no way to guarantee that a software system was protected against bugs, hackers, and vulnerabilities.
Columbia Engineering researchers may have solved this safety issue. they have developed SeKVM, the first system that guarantees, thanks to mathematical proof, the security of virtual machines in the cloud. In a new communication to be presented on May 26, 2021, at the 42nd IEEE Security and Privacy Symposium, the researchers hope to lay the groundwork for future innovations in system software verification, leading to a new generation of cyber-resilient system software.
SeKVM is the first formally verified system for cloud computing. Formal verification is a critical step because it involves proving that the software is mathematically correct, that the program code is working as it should, and that there are no hidden security bugs to worry about.
“This is the first time that an actual multiprocessor software system has proven to be mathematically correct and secure,” said Jason nieh, teacher of ccomputer science and co-director of Software Systems Laboratory. “This means that user data is properly managed by software running in the cloud and is safe from security bugs and hackers. ”
One of the great challenges of IT has been to build correct and secure system software. | Nieh has worked on various aspects of software systems since joining Columbia Engineering in 1999. When Ronghui GuTang family assistant professor of computer science and formal audit expert joined the computer science department in 2018, he and Nieh decided to collaborate on exploring the formal audit of software systems.
Their research aroused great interest: the two researchers won a Amazon Search Price, several grants from the National Science Foundation, as well as a multi-million dollar contract with the Defense Advanced Research Projects Agency (DARPA) to further develop the SeKVM project. In addition, Nieh received a Guggenheim scholarship for this job.
Much attention has been paid to formal auditing over the past twelve years, including work on auditing multiprocessor operating systems. “But all of this research was done on little toy-like systems that no one uses in real life,” Gu said. “Testing a base multiprocessor system, a widely used system like Linux, was considered more or less impossible. ”
The exponential growth of cloud computing has allowed businesses and users to move their data and computation offsite to virtual machines running on hosts in the cloud. Cloud computing providers, like Amazon, deploy hypervisors to support these virtual machines.
A hypervisor is the key piece of software that makes cloud computing possible. The security of virtual machine data depends on the accuracy and reliability of the hypervisor. Despite their importance, hypervisors are complicated: they can include an entire Linux operating system. A single weak link in the code, which is virtually impossible to detect through traditional testing, can leave a system vulnerable to hackers. Even if a hypervisor is written 99% correctly, an attacker can still sneak into that particular 1% setup and take control of the system.
Nieh and Gu’s work is the first to verify a core system, specifically the widely used KVM hypervisor, which is used to run virtual machines by cloud providers such as Amazon. They proved that SeKVM, which is KVM with a few small changes, is secure and ensures that virtual machines are isolated from each other.
“We have shown that our system can protect and secure private data and computing uploaded to the cloud with mathematical guarantees,” said Xupeng li, doctoral student of Gu and co-lead author of the article. “It has never been done before.”
SeKVM has been verified using MicroV, a new framework for verifying the security properties of mainframe systems. It’s based on the hypothesis that small changes to the system can make it considerably easier to check, a new technique researchers are calling microvertification. This new layering technique modernizes an existing system and extracts the components that enhance security into a small kernel that is verified and ensures the security of the entire system.
The changes required to modernize a large system are quite modest – researchers have shown that if the small kernel of the larger system is intact, then the system is secure and no private data will be disclosed. This is how they were able to verify a large system such as KVM, which was previously considered impossible.
“Think of a house – a crack in the drywall doesn’t mean the integrity of the house is at risk,” Nieh explained. “It’s still structurally sound and the key structural system is good. ”
Shih Wei Li, Nieh’s doctoral student and study co-lead author, added, “SeKVM will act as a safeguard in a variety of fields, from banking systems and Internet of Things devices to autonomous vehicles and cryptocurrencies.
As the first verified product hypervisor, SeKVM could change the way cloud services should be designed, developed, deployed, and trusted. In a world where cybersecurity is a growing concern, this resilience is in high demand. Large cloud companies are already exploring how they can leverage SeKVM to meet this demand.
About the study
The study is titled “A Secure and Officially Verified Linux KVM Hypervisor.”
The authors are: Shih-Wei Li, Xupeng Li, Ronghui Gu, Jason Nieh, John Zhuang Hui
Department of Computer Science, Columbia Engineering
The study was funded in part by National Science Foundation grants CCF-1918400, CNS-1717801, and CNS-1563555.
Publication details
The study will be presented at 42nd IEEE Security and Privacy Symposium on May 26, 2021.
###
CONNECTIONS:
Paper: http://www.cs.columbia.edu/~nieh/pubs/ieeesp2021_kvm.pdf
DO I: 10.1109 / SP40001.2021.00049
http://engineering.columbia.edu/
https://www.ieee-security.org/TC/SP2021/
https://www.linux-kvm.org/page/Main_Page
http://www.cs.columbia.edu/~nieh/
http://systems.cs.columbia.edu/
https://www.cs.columbia.edu/~rgu/
https://www.gf.org/annonce-2021/
https://www.amazon.science/research-awards/program-updates/2020-amazon-research-awards-recipients-announced
https://scholar.google.com/citations?user=ma7i8i8AAAAJ&hl=en
https://shihweili.com/
https://www.cs.columbia.edu
###
British Engineering
Columbia Engineering, based in New York City, is one of the best engineering schools in the United States and one of the oldest in the country. Also known as the Fu Foundation School of Engineering and Applied Sciences, the School expands knowledge and advances technology through the pioneering research of its more than 220 professors, while educating students of undergraduate and graduate in a collaborative environment to become leaders informed by a solid foundation in engineering. The school’s faculty are at the center of the university’s interdisciplinary research, contributing to the Data Science Institute, the Earth Institute, the Zuckerman Mind Brain Behavior Institute, the Precision Medicine Initiative, and the Columbia Nano Initiative. Guided by its strategic vision, “Columbia Engineering for Humanity”, the School aims to translate ideas into innovations that promote a sustainable, healthy, secure, connected and creative humanity.
Comments are closed.