Unikernel-based Approach for Software-Defined Security in Cloud Infrastructures
📜 Abstract
In this paper, we propose an approach for software-defined security in cloud infrastructures. More specifically, we show to what extent this programmability can contribute to the protection of cloud services, through the generation of secured unikernel images. These ones are instantiated in the form of lightweight virtual machines, whose attack surface is limited and whose security is driven by a security orchestrator. We introduce a method for generating secured unikernel images in an on-the-fly manner. This one permits to lead to specific and constrained resources, that integrate security mechanisms as soon as the image generation phase. These ones may be built in a reactive or proactive manner, in order to address elasticity requirements. Finally, we detail a prototyping and extensive series of experiments that are used to evaluate the benefits and limits of the proposed approach.
✨ Summary
The paper presents a software-defined security strategy in which security mechanisms are integrated into specially generated unikernel images. The prototype, based on MirageOS, implements authentication and access control for a web service. Evaluation reported in the authors’ related work found that security integration caused approximately 6.5% lower workload support, about 2 MB of additional memory under a 200-connection workload, approximately 7.87% image-generation overhead, and about 0.2 ms additional HTTP-request delay; secured unikernels nevertheless showed lower delay than the compared regular virtual-machine configuration. (docnum.univ-lorraine.fr)
Subsequent research continued the same research program by extending the approach with TOSCA-based descriptions for unikernel components and multi-level security requirements. (cv.hal.science) Later publications and surveys cite the paper as an early contribution connecting unikernel-based isolation, attack-surface reduction, and cloud-security orchestration, including work on virtualization isolation, unikernel security, and serverless security. (openreview.net) The search found evidence of continued academic citation and follow-on research, but no verified evidence of direct industrial deployment of the specific prototype described in this paper.