Year: 2025
Type: article
Abstract: The purpose of this article: development of a template protection mechanism to ensure the security of the information infrastructure during the migration of virtual machine images. Research method: analysis of hardware virtualization principles and the process of virtual machine image migration. Synthesis of a denial of service (DoS) attack scenario during the process of virtual machine image migration to an incompatible environment. Using low-level programming methods, a new protection mechanism is proposed by calling, analyzing system functions through high-level system libraries and forming a special layer of system functions to make a final decision on virtual machine image migration. The special layer of system functions is implemented as a service solution in a secure environment using the ssh protocol. The study was carried out by full-scale modeling of the Docker-based informa tion infrastructure in environments with containerization support, its deployment and testing during the implementation of the attack scenario. Result: the analysis of the threat of technical difficulties during migration of virtual machine images between cloud service providers caused by incompatibility of hardware and software is carried out, and the relevance of the problem of developing universal template security mechanisms, called patterns, is shown. A microservice architecture is built to ensure the security of the information infrastructure during migration of virtual machine images. A denial of service (DoS) attack scenario is considered during migration of a virtual machine image to an incompatible environment. A security pattern of the information infrastructure during migration of virtual machine images is developed based on microservices integrated into a Docker container. Three microservices are developed: software checks; hardware checks; hypervisor checks. A special layer of system functions has been developed to make the final decision on virtual machine image migration, including: a set of functions for checking the VirtualBox version; a function for checking system resources; a set of functions for checking file system compatibility and available disk space; a function for checking hardware and resource compatibility; a function for performing all checks and logging the results. The program code of microservices has been developed, including codes for system functions and special classes: CheckSoftware, CheckHardware, CheckHypervisor, Logs providing a protection mechanism. An algorithm for creating a security pattern in the form of a Docker container has been developed, a Dockerfile has been written, a Docker image and a Docker container have been created. Microservices have been tested, which has shown the successful operation of the protection mechanism. A system for monitoring the process of migrating a virtual machine image to an incompatible environment based on open source software and the created Docker container has been deployed, which can be used in SIEM systems, and migration error metrics can be configured through the corresponding events of special classes, which makes it possible to flexibly configure the pattern itself and apply it to various information infrastructures. Practical value: the practical value of the proposed solution includes a template protection mechanism in the form of a pattern that can be used to ensure the security of various information infrastructures consisting of a different set of VMs, hypervisors and servers, including transferring the developed solution to any industry: fuel and energy, economic and not only, due to the cross-platform nature of the solution itself.
Source: Voprosy kiberbezopasnosti
Authors: N.V Korneev, A.B. Dikiy
Institution: Gubkin Russian State University of Oil and Gas
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: bronze
OpenAlex ID: W4409621402