View source for Journal:Virtualization-based security techniques on mobile cloud computing: Research gaps and challenges

{{Infobox journal article
|name         = 
|image        = 
|alt          = <!-- Alternative text for images -->
|caption      = 
|title_full   = Virtualization-based security techniques on mobile cloud computing: Research gaps and challenges
|journal      = ''International Journal of Interactive Mobile Technologies''
|authors      = Annane, Boubakeur; Ghazali, Osman
|affiliations = Universiti Utara Malaysia
|contact      = Email: jakhar256 at yahoo dot com
|editors      = 
|pub_year     = 2019
|vol_iss      = '''13'''(4)
|pages        = 20–32
|doi          = [https://doi.org/10.3991/ijim.v13i04.10515 10.3991/ijim.v13i04.10515]
|issn         = 1865-7923
|license      = [https://creativecommons.org/licenses/by/3.0/at/deed.en_GB Creative Commons Attribution 3.0 Austria]
|website      = [https://online-journals.org/index.php/i-jim/article/view/10515 https://online-journals.org/index.php/i-jim/article/view/10515]
|download     = [https://online-journals.org/index.php/i-jim/article/download/10515/5587 https://online-journals.org/index.php/i-jim/article/download/10515/5587] (PDF)
}}

==Abstract==
The principle constraints of mobile devices are their limited resources, including processing capability, storage space, and battery life. However, [[cloud computing]] offers a means of vast computing resources and services. With it a new idea emerged, the inclusion of cloud computing into mobile devices such as smartphones, tablet, and other personal digital assistants (PDA) to augment their capacities, providing a robust technology called mobile cloud computing (MCC). Although MCC has brought many advantages to mobile users, it also still suffers from the security and privacy issues of data while hosted on virtual machines (VM) on remote cloud’s servers. Currently, the eyes of security experts are turned towards the virtualization-based security techniques used either on the cloud or on mobile devices. The new challenge is to develop secure methods in order to authenticate highly sensitive digital content. This paper investigates the main challenges regarding the security and privacy issues inherent to the mobile cloud, focusing on the virtualization issue layer and giving clear strengths and weaknesses of recent relevant virtualization security techniques existing in the literature. Hence, the paper provides perspectives for researchers to adapt in order to achieve progress with future work.

'''Keywords''': mobile cloud computing; virtualization; security and privacy of information; user virtual machines

==Introduction==
Nowadays, [[cloud computing]] is an attractive technology that is known to have an increasing importance for users by delivering services over the internet. It is defined as an information technology (IT) paradigm that allows the user to exploit cloud services in an on-demand way.<ref name="DengAHOme11">{{cite journal |title=A Home Healthcare System in the Cloud--Addressing Security and Privacy Challenges |journal=IEEE 4th International Conference on Cloud Computing |author=Deng, M.; Petkovic, M.; Nalin, M. et al. |pages=549-556 |year=2011 |doi=10.1109/CLOUD.2011.108}}</ref> Three main services are provided: infrastructure as a service (IaaS), platform as a service (PaaS), and [[software as a service]] (SaaS). In IaaS, virtualization relies on sharing computing resources rather than having personal mobile devices to handle and to perform applications and tasks simultaneously and efficiently.<ref name="RahimiMobile14">{{cite journal |title=Mobile Cloud Computing: A Survey, State of Art and Future Directions |journal=Mobile Networks and Applications |author=Rahimi, M.R.; Rn, J.; Liu, C.H. et al. |volume=19 |issue=2 |pages=133–43 |year=2014 |doi=10.1007/s11036-013-0477-4}}</ref>

Mobile cloud computing (MCC) has quickly grown in popularity among individuals and user communities. It combines the cloud computing paradigm with mobile devices through wireless technology in order to avoid the devices’ capacity restrictions and leverage the resources offered by cloud computing services.<ref name="ZhangEnsuring17">{{cite journal |title=Ensuring attribute privacy protection and fast decryption for outsourced data security in mobile cloud computing |journal=Information Sciences |author=Zhang, Y.; Chen, X.; Li, J. et al. |volume=379 |pages=42–61 |year=2017 |doi=10.1016/j.ins.2016.04.015}}</ref> Mobile devices such as smartphone and tablets have several limitations in their resource capacities (CPU, memory, and storage space) which inhibit application developers from providing powerful software solutions and hinder users in enjoying those solutions in their daily life.<ref name="RahimiMobile14" /> Integrating cloud computing services with mobile computing is an interesting solution towards solving these issues. MCC allows users to upload and move their applications, services, and data on shared cloud servers, taking advantage of their large remote storage capacity and significant computing resources when running intensive applications, taking the strain off the battery life of mobile devices. Recently, the use of mobile devices has moved beyond simple applications and into more complex and crucial applications which deal with sensitive data in various multimedia formats (text, images, audio, and video), including banking, health, and transport applications. The moving of clients’ data and services to the cloud raises many security challenges, particularly involving the major concerns of data security and privacy protection due to data being located in different distributed places.

Security is considered a major challenge with MCC environments. Mobile cloud security's issues are inherited from cloud computing, so we are at least familiar with those issues; however, those issues are more critical with MCC because of devices’ limited resource capacity (e.g., lack of CPU capability) to handle CPU-intensive malware detection applications that protect sensitive data, at least when compared to personal computers. The tenants’ worries are concentrated on the migration to the cloud of their data, which might face more risks once they share the same cloud resources with other tenants.<ref name="MollahSecurity17">{{cite journal |title=Security and privacy challenges in mobile cloud computing: Survey and way ahead |journal=Journal of Network and Computer Applications |author=Mollah, M.B.; Azad, M.A.K.; Vasilakos, A. |volume=84 |pages=38–54 |year=2017 |doi=10.1016/j.jnca.2017.02.001}}</ref> With MCC, cloud service providers offer the sharing of their resources to mobile users through the popular technique of virtualization, which increases the efficiency and effectiveness of hardware utilization.<ref name="HanUsing15">{{cite journal |title=Using Virtual Machine Allocation Policies to Defend against Co-Resident Attacks in Cloud Computing |journal=IEEE Transactions on Dependable and Secure Computing |author=Han, Y.; Chan, J.; Alpcan, T. et al. |volume=14 |issue=1 |pages=95–108 |year=2015 |doi=10.1109/TDSC.2015.2429132}}</ref> Various users’ virtual machines are running on the same cloud host when they share the same cloud resources, which leads to additional security risks like violating data use terms once the data shares the same memory or CPU.<ref name="RistenpartHeyYou09">{{cite journal |title=Hey, you, get off of my cloud: Exploring information leakage in third-party compute clouds |journal=Proceedings of the 16th ACM Conference on Computer and Communications Security |author=Ristenpart, T.; Tromer, E.; Shacham, H. et al. |pages=199–212 |year=2009 |doi=10.1145/1653662.1653687}}</ref><ref name="ZhangCross12">{{cite journal |title=Cross-VM side channels and their use to extract private keys |journal=Proceedings of the 2012 ACM Conference on Computer and Communications Security |author=Zhang, Y.; Juels, A.; Reiter, M.K. et al. |pages=305–316 |year=2012 |doi=10.1145/2382196.2382230}}</ref> Consequently, an important question must be raised whether the other cloud virtual machines’ clients are trusted or not. Several robust security techniques have been proposed in this decade, and a number of new techniques or improved versions of the latest approaches have been developed. However, most of the solutions proposed are not practical due to the critical change—eliminating side channels and clocks, as well as the hypervisor—that comes with the cloud platform.<ref name="HanUsing15" /> In this work, we aim to collect and present some relevant virtualization-based security techniques currently available in the field and review in detail the topic of various newly emerged security challenges.

The rest of this paper is organized as follows. Firstly, we present basic requirements of the virtualization techniques on MCC. We detail malicious attacks and briefly review quality measures. Then, we discuss the recent virtualization security techniques, with comparison and evaluation of different approaches also presented. Then, we present discussion, research gaps, and challenges concerning a security-based virtualization layer. Finally, in the last section, we conclude and present plans for future work.

==Virtualization-based security preliminaries==
In MCC, cloud services are provided for mobile users using virtualization technologies. Virtualization is defined as a middle layer between the software and hardware layers in a cloud server that allows the cloud provider to efficiently exploit their services and computing resources.<ref name="SgandurraEvol16">{{cite journal |title=Evolution of Attacks, Threat Models, and Solutions for Virtualized Systems |journal=ACM Computing Surveys (CSUR) |author=Sgandurra, D.; Lupu, E. |volume=48 |issue=3 |pages=46 |year=2016 |doi=10.1145/2856126}}</ref> These resources can be shared among multiple virtual machines in order to run services simultaneously while also sharing benefits from available servers’ resources (e.g., CPU, network bandwidth, memory, etc.).<ref name="IslamMobile17">{{cite journal |title=Mobile Cloud-Based Big Healthcare Data Processing in Smart Cities |journal=IEEE Access |author=Islam, M.; Rzzaque, A.; Hassan, M.H. et al. |volume=5 |pages=11887–11899 |year=2017 |doi=10.1109/ACCESS.2017.2707439}}</ref> The virtualization process can reportedly increase hardware utilization (efficiency) between 60% and 80%.<ref name="HuAReview11">{{cite journal |title=A Review on Cloud Computing: Design Challenges in Architecture and Security |journal=Journal of Computing and Information Technology |author=Hu, F.; Qiu, M.; Li, J. et al. |volume=19 |issue=1 |pages=25–55 |year=2011 |doi=10.2498/cit.1001864}}</ref> The use of remote servers and other hardware utilization techniques also improves mobile device battery life by saving energy.<ref name="EllouzeAMobile15">{{cite journal |title=A Mobile Application Offloading Algorithm for Mobile Cloud Computing |journal=Proceedings of the 3rd IEEE International Conference on Mobile Cloud Computing, Services, and Engineering |author=Ellouze, A.; Gagnaire, M.; Haddad, A. |pages=34–40 |year=2015 |doi=10.1109/MobileCloud.2015.11}}</ref><ref name="DhanyaAdapt15">{{cite journal |title=Adaptive and Secure Application Partitioning for Offloading in Mobile Cloud Computing |journal=SSCC 2015: International Symposium on Security in Computing and Communication |author=Dhanya, N.M.; Kousalya, G. |pages=45–53 |year=2015 |doi=10.1007/978-3-319-22915-7_5}}</ref>

The execution of mobile applications is considered a computationally intensive task that requires significant resource consumption on mobile devices. However, this kind of challenge has been defeated by the offloading technique. The computationally intensive application is divided into many tasks, which are migrated to the cloud (remote servers) for fast processing, with the results returned back to the mobile terminal afterwards.<ref name="ShirazARev13">{{cite journal |title=A Review on Distributed Application Processing Frameworks in Smart Mobile Devices for Mobile Cloud Computing |journal=IEEE Communications Surveys & Tutorials |author=Shiraz, M.; Gani, A.; Jhokhar, R. et al. |volume=15 |issue=3 |pages=1294–1313 |year=2013 |doi=10.1109/SURV.2012.111412.00045}}</ref> On the cloud end, once the mobile task is offloaded, a virtual machine image of the mobile device (also called a "phone clone") is pre-installed for processing the mobile user’s application data, which increases the efficiency of the cloud environment and decreases the maintenance overhead on the mobile device.<ref name="MollahSecurity17" /><ref name="SahooVirt10">{{cite journal |title=Virtualization: A Survey on Concepts, Taxonomy and Associated Security Issues |journal=Second International Conference on Computer and Network Technology |author=Sahoo, J.; Mohapatra, S.; Lath, R. |pages=222–226 |year=2010 |doi=10.1109/ICCNT.2010.49}}</ref> Therefore, running the phone clone of the mobile device on the same server and isolating them is the main role of the virtualization technology. However, multiple works<ref name="HanUsing15" /><ref name="RistenpartHeyYou09" /><ref name="HaoSMOC15">{{cite journal |title=SMOC: A secure mobile cloud computing platform |journal=2015 IEEE Conference on Computer Communications |author=Hao, Z.; Tang, Y.; Zhang, Y. et al. |pages=2668-2676 |year=2015 |doi=10.1109/INFOCOM.2015.7218658}}</ref><ref name="PaladiProvid17">{{cite journal |title=Providing User Security Guarantees in Public Infrastructure Clouds |journal=IEEE Transactions on Cloud Computing |author=Paladi, N.; Gehrmann, C.; Michalas, A. |volume=5 |pages=405-419 |year=2017 |doi=10.1109/TCC.2016.2525991}}</ref><ref name="HanVirtual14">{{cite journal |title=Virtual machine allocation policies against co-resident attacks in cloud computing |journal=2014 IEEE International Conference on Communications |author=Han, Y.; Chan, J.; Alpcan, T. et al. |pages=786-792 |year=2014 |doi=10.1109/ICC.2014.6883415}}</ref><ref name="YuDetect13">{{cite journal |title=Detecting VMs Co-residency in Cloud: Using Cache-based Side Channel Attacks |journal=Elektronika ir Elektrotechnika |author=Yu, S.; Xiaolin, G.; Jiancai, L. et al. |volume=19 |issue=5 |pages=73–78 |year=2013 |doi=10.5755/j01.eee.19.5.2422}}</ref><ref name="VaezpourANew16">{{cite journal |title=A new approach to mitigating security risks of phone clone co-location over mobile clouds |journal=Journal of Network and Computer Applications |author=Vaezpour, S.Y.; Zhang, R.; Wi, K. et al. |volume=62 |pages=171–184 |year=2016 |doi=10.1016/j.jnca.2016.01.005}}</ref> have shown that virtualization has brought with it several security concerns<ref name="SgandurraEvol16" /> that affect virtualized systems, including denial-of-service (DOS) attacks. This kind of attack hits insipid information like workload statistics to know whether the system is vulnerable or not. Moreover, virtualization techniques on MCC brings new security risks such as unauthorized access from malicious virtual machines (VMs), VM-to-VM attacks, breaches of confidential mobile user data, VM monitoring challenges (e.g., the hypervisor), and communication challenges in a virtualized environment.<ref name="MollahSecurity17" /><ref name="SgandurraEvol16" /> Thus, ensuring security mechanisms that prevent leakage of sensitive data and information from legitimate phone clones is not an easy task.

In terms of security, virtualization-based techniques are regrouped into two main categories: hardware-based techniques and software-based techniques. For the first class, we distinguish secure application cloning on VM<ref name="HaoSMOC15" /> and the protection of VMs from a malicious hypervisor<ref name="JinH-SVM15">{{cite journal |title=H-SVM: Hardware-Assisted Secure Virtual Machines under a Vulnerable Hypervisor |journal=IEEE Transactions on Computers |author=Jin, S.; Ahn, J.; Seol, J. et al. |volume=64 |issue=10 |pages=2833–2846 |year=2015 |doi=10.1109/TC.2015.2389792}}</ref> as two useful techniques. For the second, we also consider two techniques: VM-based security techniques<ref name="PaladiProvid17" /><ref name="HanVirtual14" /><ref name="YuDetect13" /><ref name="LiangALight15">{{cite journal |title=A Lightweight Security Isolation Approach for Virtual Machines Deployment |journal=Inscrypt 2014: International Conference on Information Security and Cryptology |author=Liang, H.; Han, C.; Zhang, D. et al. |pages=516–529 |year=2015 |doi=10.1007/978-3-319-16745-9_28}}</ref> and security techniques based on load balancing the VM.<ref name="HanUsing15" /><ref name="VaezpourANew16" /> Fig. 1 summarizes the important classes of virtualization-based security approaches.


[[File:Fig1 Annane IntJInterMobileTech2019 13-4.png|836px]]
{{clear}}
{| 
 | STYLE="vertical-align:top;"|
{| border="0" cellpadding="5" cellspacing="0" width="836px"
 |-
  | style="background-color:white; padding-left:10px; padding-right:10px;"| <blockquote>'''Fig. 1''' Classification of virtualization-based security techniques</blockquote>
 |- 
|}
|}

Virtualization-based security techniques have five important proprieties<ref name="HanVirtual14" /><ref name="SuoSecur13">{{cite journal |title=Security and privacy in mobile cloud computing |journal=Proceedings from the 9th International Wireless Communications and Mobile Computing Conference |author=Suo, H.; Liu, Z.; Wan, J. et al. |pages=655–659 |year=2013 |doi=10.1109/IWCMC.2013.6583635}}</ref>: efficiency, coverage, complexity, security, and robustness. Roughly speaking, efficiency represents the number of malicious VMs that succeed to co-locate with a target (victim VM), divided by the total number of VMs lunched by the attacker. Coverage represents the number of malicious VMs that succeed to co-locate with a target, divided by the number of targets lunched by a legitimate user. Complexity in security is defined as any secure complex technique that needs high execution time, high computation complexity, and high energy consumption from the cloud server. Security refers to the privacy of the VMs and their sensitive data, meaning that optimally no one would be able to remove or extract the data without knowing the secure key. Similarly, robustness refers to the degree of resistance against any kind of manipulation. Any new approach must negotiate a trade-off among these five proprieties.

Many researchers have begun developing frameworks, policies, and approaches against these kinds of challenges to ensure security for mobile users. These methods are mainly focused on how to ignore the side channel attacks between VMs while the malicious VMs access the cloud servers.<ref name="VattikondaElim11">{{cite journal |title=Eliminating fine grained timers in Xen |journal=Proceedings of the 3rd ACM Workshop on Cloud Computing Security Workshop |author=Vattikonda, B.C.; Das, S.; Shacham, H. |pages=41–46 |year=2011 |doi=10.1145/2046660.2046671}}</ref><ref name="WuXenPump12">{{cite journal |title=XenPump: A New Method to Mitigate Timing Channel in Cloud Computing |journal=IEEE Fifth International Conference on Cloud Computing |author=Wu, J.; Ding, L.; Lin, Y. et al. |pages=678–685 |year=2012 |doi=10.1109/CLOUD.2012.28}}</ref><ref name="AviramDeterm10">{{cite journal |title=Determinating timing channels in compute clouds |journal=Proceedings of the 2010 ACM Workshop on Cloud Computing Security Workshop |author=Aviram, A.; Hu, S.; Ford, B. et al. |pages=103–108 |year=2010 |doi=10.1145/1866835.1866854}}</ref><ref name="ShiLimit11">{{cite journal |title=Limiting cache-based side-channel in multi-tenant cloud using dynamic page coloring |journal=IEEE/IFIP 41st International Conference on Dependable Systems and Networks Workshops |author=Shi, J.; Song, X.; Chen, H. et al. |pages=194–199 |year=2011 |doi=10.1109/DSNW.2011.5958812}}</ref> However, all the methods proposed require fundamental changes to the current commercial platform, and they are neither practical nor immediately deployable.<ref name="HanVirtual14" /> Additionally, while also strong candidates, hardware-based techniques lead to a high cost barrier.<ref name="HaoSMOC15" />

==Virtualization-based security techniques==
How to protect virtual machines (VM) and sensitive data is undoubtedly one of the most important topics regarding MCC. Recent security techniques have been used largely to tackle the security issues related to the virtualized environment in either cloud or mobile cloud computing.<ref name="HanUsing15" /><ref name="HaoSMOC15" /><ref name="PaladiProvid17" /><ref name="HanVirtual14" /><ref name="YuDetect13" /><ref name="VaezpourANew16" /><ref name="JinH-SVM15" /><ref name="LiangALight15" /> This section discusses recent techniques described in the literature.

===Virtualization-based security VM techniques===
====Hardware virtualization-based technique for securing application cloning on VM====
Hao ''et al.''<ref name="HaoSMOC15" /> have presented a platform called Secure Mobile Cloud Platform (SMOC) for securing the mobile cloud environment. The platform allows the user to run their applications whether on the cloud or directly on the mobile device itself. In contrast, their proposed platform includes two concepts. The first one is sharing resources, which means that a mobile application can freely change the run-from location for providing a better user experience, i.e., not running explicitly on the cloud. This design provides more flexibility compared to other proposed approaches and techniques. The second concept is ensuring security even though the operating system of the mobile device has been attacked. A thin virtual machine shares its information and files with the mobile device once the mobile application is running in the cloud. Conversely, the mobile device shares its files and information (device inputs and outputs) with the VM-cloud for running the application. Despite the benefits of this platform towards security concerns, many assumptions are made by the researchers, who fail to consider issues with an untrusted hypervisor and untrusted public cloud provider. The proposed platform ensures data security and privacy only when both assumptions (hypervisor and cloud provider) are assured. Thus, this platform ensures security towards an untrusted guest operating system which also runs unsecure applications.

====Encryption protocol-based virualization technique for trusting launch of VM====


==References==
{{Reflist|colwidth=30em}}

==Notes==
This presentation attempts to remain faithful to the original, with only a few minor changes to presentation. Grammar and punctuation has been updated reasonably to improve readability. In some cases important information was missing from the references, and that information was added. References appear in the order of the inline citations, by design.

<!--Place all category tags here-->
[[Category:LIMSwiki journal articles (added in 2019)‎]]
[[Category:LIMSwiki journal articles (all)‎]]
[[Category:LIMSwiki journal articles on cloud computing]]
[[Category:LIMSwiki journal articles on cybersecurity]]