Science & Enterprise subscription

Follow us on Twitter

  • Nine universities in the U.S. are taking part in a program supporting research and entrepreneurs developing food an…
    about 3 hours ago
  • New post on Science and Enterprise: Nine Campuses Join Rural Food Research Fund #Science #Business
    about 3 hours ago
  • Spark Therapeutics, a developer of gene therapies, is gaining access to a technology that programs DNA sequences li…
    about 1 day ago
  • New post on Science and Enterprise: Gene Therapy Company Exploring DNA Circuit Technology #Science #Business
    about 1 day ago
  • A study with lab mice shows an experimental vaccine with engineered bacteria produces antibodies and protects again…
    about 1 day ago

Please share Science & Enterprise

Univ., IBM Team Creates Enhanced Cloud Security Technique

Peng Ning (Roger Winstead, North Carolina State University)

Peng Ning (Roger Winstead, North Carolina State University)

Computer scientists from North Carolina State University in Raleigh and IBM have developed a technique to better protect sensitive information in cloud computing, without compromising overall system performance. The research team, led by NC State professor Peng Ning (pictured left), will present its findings later in October at the 18th ACM Conference on Computer and Communications Security in Chicago.

In cloud computing, the computational power and storage of multiple computers is pooled and shared by multiple users. This sharing of computing power is made possible by programs called hypervisors that create the virtual workspace that allows different operating systems to run in isolation from one another.

One concern about cloud computing is the potential vulnerability of a hypervisor that can enable an attacker to steal or corrupt confidential data from other users in the cloud. The NC State/IBM team developed a new approach that isolates sensitive information and workload from the rest of the functions performed by a hypervisor.

Ning and colleagues call the new technique Strongly Isolated Computing Environment (SICE), which introduces a different layer of protection. SICE lets programmers dedicate specific cores on multi-core processors to the sensitive workload, thus allowing the other cores to perform all other functions normally. A core is a single processor on a computer chip, and many computers now use chips that have from two to eight cores.

By isolating the sensitive workload to one or a few cores and allowing other functions to operate separately, SICE can provide more assurance for the sensitive workload and efficient resource sharing in a cloud. Also, the software supporting the technique, called Trusted Computing Base, is about 300 lines of code, which helps further isolate the technique. “Previous techniques have exposed thousands of lines of code to potential attacks,” says Ning. “We have a smaller attack surface to protect.”

In testing, SICE generally took up about three percent of the system’s performance overhead on multi-core processors for workloads that do not require direct network access. “That is a fairly modest price to pay for the enhanced security,” Ning says.

Read more:

*     *     *

Comments are closed.