VCCBox: Practical Confinement of Untrusted Software in Virtual Cloud Computing

摘要: Recent maturity of virtualization has enabled its wide adoption in cloud environment. However, legacy security issues still exist the and are further enlarged. For instance, execution untrusted software may cause more harm to system security. Though conventional sandboxes can be used constrain destructive program behaviors, they suffer from various deficiencies. In this paper, we propose VCCBox, a practical sandbox that confines applications Leveraging state-of-the-art hardware assisted technology novel design, it is able work effectively efficiently. VCCBox implements call interception access control policy enforcement inside hypervisor create an interface dynamically load policies. The in-VMM design renders our hard bypass easy deploy environment, dynamic loading provides high efficiency. We have implemented proof-of-concept based on Xen evaluation exhibits achieves goal effectiveness