Preventing cloud cartography
View Patent ↗Technologies are presented for a network/hypervisor approach to maintain a stable and separate network address for the hypervisor on a multi-tenant system and changeable network addresses for the virtual machines (VMs). In some examples, the VM addresses may be decoupled from the domain address for the hypervisor so they can be changed arbitrarily and independently without impacting command messaging, and the domain address for the hypervisor may not form a part of the delivery chain for messages to the VMs. The system may also consume only the same number of IP addresses as currently used.
1. A method for preventing cloud cartography in cloud-based datacenters, the method comprising:
providing access to a plurality of virtual machines operable to be executed on one or more physical machines within a datacenter through a virtual machine monitor; and
decoupling addresses of the plurality of virtual machines from an address of the virtual machine monitor such that the address of the virtual machine monitor is excluded from a delivery chain of messages to the plurality of virtual machines;
associating each customer account of the datacenter with a table linking random addresses to different zones and instance sizes such that an address is drawn from an appropriate population on a customer's table when the customer requests an instance fitting one of a zone and an instance size; and
assigning each customer a distinct table such that an attacker receives positive false results for instance placement and co-residency determinations.
2. The method according to claim 1 , wherein the addresses of the plurality of virtual machines and the address of the virtual machine monitor are according to Internet Protocol (IP).
3. The method according to claim 2 , further comprising
decoupling the addresses of the plurality of virtual machines from the address of the virtual machine monitor by adding a name space between an IP layer and transport protocols.
4. The method according to claim 3 , wherein the name space includes cryptographic identifiers.
5. The method according to claim 4 , wherein the cryptographic identifiers are distinct IP addresses for each virtual machine assigned within the datacenter according to Host Identity Protocol (HIP).
6. The method according to claim 5 , wherein the IP addresses are transparent to an application external to the datacenter.
7. The method according to claim 5 , wherein each IP address is associated with a set of ports, security protocol, and one or more sessions for each virtual machine.
8. The method according to claim 5 , further comprising
assigning the IP addresses to the virtual machines in a random order.
9. The method according to claim 5 , further comprising:
assigning an IP address to the virtual machine monitor from a dedicated range of IP addresses not accessible to external traffic; and
assigning the IP addresses to the virtual machines in a random order upon creation of each virtual machine, wherein the virtual machine monitor is configured to pass messages to the virtual machines through a direct method avoiding a network hop between the virtual machine monitor and the virtual machines.
10. A cloud-based datacenter configured to prevent cloud cartography, the datacenter comprising:
a plurality of virtual machines operable to be executed on one or more physical machines;
a virtual machine monitor configured to provide access to the plurality of virtual machines;
a datacenter controller configured to:
decouple addresses of the plurality of virtual machines from an address of the virtual machine monitor such that the address of the virtual machine monitor is excluded from a delivery chain of messages to the plurality of virtual machines, wherein the addresses of the plurality of virtual machines and the address of the virtual machine monitor are according to Internet Protocol (IP);
associate each customer account of the datacenter with a table linking random addresses to different zones and instance sizes such that an address is drawn from an appropriate population on a customer's table when the customer requests an instance fitting one of a zone and an instance size; and
assign each customer a distinct table such that an attacker receives positive false results for instance placement and co-residency determinations.
11. The datacenter according to claim 10 , wherein the addresses of the plurality of virtual machines and the address of the virtual machine monitor are according to Internet Protocol (IP), and the datacenter controller is further configured to decouple the addresses of the plurality of virtual machines from the address of the virtual machine monitor by adding a name space between an IP layer and transport protocols.
12. The datacenter according to claim 11 , wherein the datacenter controller is further configured to:
assign an IP address to the virtual machine monitor from a dedicated range of IP addresses not accessible to external traffic; and
assign the IP addresses to the virtual machines in a random order upon creation of each virtual machine.
13. The datacenter according to claim 10 , wherein the virtual machine monitor is configured to pass messages to the virtual machines through a direct method avoiding a network hop between the virtual machine monitor and the virtual machines.
14. The datacenter according to claim 10 , wherein the address for the virtual machine monitor is dedicated to management communications.
15. The datacenter according to claim 10 , wherein the virtual machine monitor is further configured to intermediate access to physical machines and data storage.
16. The datacenter according to claim 10 , wherein the datacenter includes a plurality of virtual machine monitors, each virtual machine monitor associated with a group of virtual machines and each virtual machine monitor assigned an address from a dedicated range of addresses not accessible to external traffic.
17. A non-transitory computer-readable storage medium having instructions stored thereon for preventing cloud cartography in cloud-based datacenters, the instructions comprising:
providing access to a plurality of virtual machines operable to be executed on one or more physical machines within a datacenter through a virtual machine monitor; and
decoupling addresses of the plurality of virtual machines from an address of the virtual machine monitor such that the address of the virtual machine monitor is excluded from a delivery chain of messages to the plurality of virtual machines;
associating each customer account of the datacenter with a table linking random addresses to different zones and instance sizes such that an address is drawn from an appropriate population on a customer's table when the customer requests an instance fitting one of a zone and an instance size; and
assigning each customer a distinct table such that an attacker receives positive false results for instance placement and co-residency determinations.
18. The non-transitory computer-readable storage medium according to claim 17 , wherein the virtual machine monitor is configured to pass messages to the virtual machines through a direct method avoiding a network hop between the virtual machine monitor and the virtual machines.
19. The non-transitory computer-readable storage medium according to claim 18 , wherein the virtual machine monitor is configured to pass messages to the virtual machines through one or more paravirtualized network drivers.