Real-time Auditing of the Runtime Environment for Cloud Computing Platforms

In this paper we show how to perform efficient auditing of the runtime environment for virtual machines in public cloud systems or standalone computer systems. The goal is to perform real-time integrity checking of executable codes and library files that will be dynamically linked before an application is launched. Auditing these binary files according to their hash values stored in a local machine is deficient because malware or viruses infecting those files can simultaneously alter their corresponding hash values. We propose an effective scheme to perform real-time auditing of such binary files. First, a status code that represents the current status of all executable codes and library files in the runtime environment and comprises only 32 bytes is downloaded from a trusted remote computer. Second, a full binary hash tree is used to perform efficient auditing of files that will be executed and linked by an application according to the downloaded status code. Finally, this application can then be launched safely. We used a real operating system to evaluate the performance of the proposed scheme, and the obtained experimental results demonstrated its feasibility.