NC State and IBM Researchers Discover New Way to Patch Holes in The ‘Cloud’

Researchers from North Carolina State University and IBM have invented a way to update computer systems packaged in virtual machines in a computer “cloud” – even when those programs are offline.

The new cloud computing patch tool developed by NC State and IBM is called Nuwa and protects virtual machines (VMs) from cyber-attacks by ensuring that they always receive important security upgrades. In addition, the researchers have determined that offline application of security patches is more than four times faster than online patch application. The tool is named after a Chinese goddess who patched a hole in the sky.

A paper describing the research, “Always Up-to-date – Scalable Offline Patching of VM Images in a Compute Cloud,” will be presented Dec. 10 at the Annual Computer Security Applications Conference in Austin, Texas.

“We’ve designed a way to patch these virtual machines while they are offline, so that they are kept up to date in terms of security protection,” says Dr. Peng Ning, professor of computer science at NC State and co-author of a paper describing the research. “Current patching systems are designed for computers that are online and they don’t work for dormant computers or virtual machines. The tool we developed automatically analyzes the ‘script’ that dictates how a security patch is installed, and then automatically re-writes the script to make it compatible with an offline system.”

Nuwa leverages a collection of techniques developed by IBM, called Mirage, that is used for performing efficient offline introspection and manipulation of a large collection of VM images, to allow cloud administrators to patch multiple VMs simultaneously. A program already exists that allows cloud computing systems to operate more efficiently by saving one version of a computer file that is used by multiple VMs – rather than saving the same file repeatedly for each individual VM. Nuwa takes advantage of this technology and, by patching one file, can ultimately protect all of the VMs that use that file.

NC State and IBM have successfully tested and evaluated Nuwa on the IBM Research Compute Cloud, a compute cloud that is used by IBM researchers worldwide.

Cloud computing enables users to create many VMs on one large computing platform, with each VM being able to perform various computer functions. It is so easy to create these VMs, that businesses and individuals will often create them to perform very specific tasks on a periodic basis. Because many of these VMs are used infrequently, they are often left dormant for extended periods of time, so that they are not consuming energy and computer resources when not in use.

These dormant periods pose a significant security problem, because VMs that are offline do not receive security upgrades, known as patches. This leaves the VMs vulnerable to cyber-attacks when they are brought back online. The VMs are particularly vulnerable if they have been left dormant for months, and missed significant patches.

The research collaboration was funded by the National Science Foundation and IBM. The lead author on the paper is Wu Zhou, a Ph.D. student at NC State. Co-authors are Ning; Xiaolan Zhang, Glenn Ammons and Vasanth Bala of the IBM T.J. Watson Research Center; and Ruowen Wang, a Ph.D. student at NC State.

NC State’s computer science department is part of the university’s College of Engineering.

-shipman-

Note to editors: The study abstract follows.

“Always Up-to-date – Scalable Offline Patching of VM Images in a Compute Cloud”

Authors: Wu Zhou, Peng Ning, Ruowen Wang, North Carolina State University; Xiaolan Zhang, Glenn Ammons, Vasanth Bala, IBM T. J. Watson Research Center

Presented: Dec. 10, 2010, at the Annual Computer Security Applications Conference, Austin, Texas

Abstract: Patching is a critical security service that keeps computer systems up to date and defends against security threats. Existing patching systems all require running systems. With the increasing adoption of virtualization and cloud computing services, there is a growing number of dormant virtual machine (VM) images. Such VM images cannot benefit from existing patching systems, and thus are often left vulnerable to emerging security threats. It is possible to bring VM images online, apply patches, and capture the VMs back to dormant images. However, such approaches suffer from unpredictability, performance challenges, and high operational costs, particularly in large-scale compute clouds where there could be thousands of dormant VM images.

This paper presents a novel tool named Nuwa that enables efficient and scalable offline patching of dormant VM images. Nuwa analyzes patches and, when possible, converts them into patches that can be applied offline by rewriting the patching scripts. Nuwa also leverages the VM image manipulation technologies offered by the Mirage image library to provide an efficient and scalable way to patch VM images in batch. Nuwa has been evaluated on freshly built images and on real-world images from the IBM Research Compute Cloud (RC2), a compute cloud used by IBM researchers worldwide. When applying security patches to a fresh installation of Ubuntu-8.04, Nuwa successfully applies 402 of 406 patches. It speeds up the patching process by more than 4 times compared to the online approach and by another 2–10 times when integrated with Mirage. Nuwa also successfully applies the 10 latest security updates to all VM images in RC2.