E-BOOT: Preventing Boot-Time Entropy Starvation in Cloud Systems
Due to the impracticability of generating true randomness by running deterministic algorithms in computers, boot-loaders and operating systems undergo the lack of enough supplies of entropy at boot-time. This problem remains a challenge and affects all computer systems, including virtualization tech...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2020-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/9050782/ |
| _version_ | 1818579505238769664 |
|---|---|
| author | Fernando Vano-Garcia Hector Marco-Gisbert |
| author_facet | Fernando Vano-Garcia Hector Marco-Gisbert |
| author_sort | Fernando Vano-Garcia |
| collection | DOAJ |
| description | Due to the impracticability of generating true randomness by running deterministic algorithms in computers, boot-loaders and operating systems undergo the lack of enough supplies of entropy at boot-time. This problem remains a challenge and affects all computer systems, including virtualization technologies. Unfortunately, this situation leads to undesired side effects, affecting the security of important kernel components and causing large blocking waits in the start-up of userland processes. For example, SSHD is delayed up to 4 minutes. In this paper, we analyze the boot-time entropy starvation problem, performing a comprehensive analysis of the Linux kernel boot process revealing that the problem not only affects userland applications but up to 33 kernel functions at boot time. Those functions are weakly fed by random numbers from a non-initialized CSPRNG. To overcome this problem, we propose E-Boot, a novel technique that provides high-quality random numbers to guest virtual machines. E-Boot is the first technique that completely satisfies the entropy demand of virtualized boot-loaders and operating systems at boot time. We have implemented E-Boot in Linux v5.3 and our experiments show that it effectively solves the boot-time entropy starvation problem. Our proposal successfully feeds bootloaders and boot time Linux kernel hardening techniques with high-quality random numbers, reducing also to zero the number of userspace blocks and delays. The total time overhead introduced by E-Boot is around 2 μs and has zero memory overhead, since the memory is freed before the kernel boot ends, which makes E-boot a practical solution for cloud systems. |
| first_indexed | 2024-12-16T07:02:46Z |
| format | Article |
| id | doaj.art-8d719e14fd7c4cc2bcf93f7ce0ce39f6 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-16T07:02:46Z |
| publishDate | 2020-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-8d719e14fd7c4cc2bcf93f7ce0ce39f62022-12-21T22:40:06ZengIEEEIEEE Access2169-35362020-01-018618726189010.1109/ACCESS.2020.29844149050782E-BOOT: Preventing Boot-Time Entropy Starvation in Cloud SystemsFernando Vano-Garcia0https://orcid.org/0000-0001-6158-8694Hector Marco-Gisbert1https://orcid.org/0000-0001-6976-5763School of Computing, Engineering and Physical Sciences, University of the West of Scotland, Paisley, U.K.School of Computing, Engineering and Physical Sciences, University of the West of Scotland, Paisley, U.K.Due to the impracticability of generating true randomness by running deterministic algorithms in computers, boot-loaders and operating systems undergo the lack of enough supplies of entropy at boot-time. This problem remains a challenge and affects all computer systems, including virtualization technologies. Unfortunately, this situation leads to undesired side effects, affecting the security of important kernel components and causing large blocking waits in the start-up of userland processes. For example, SSHD is delayed up to 4 minutes. In this paper, we analyze the boot-time entropy starvation problem, performing a comprehensive analysis of the Linux kernel boot process revealing that the problem not only affects userland applications but up to 33 kernel functions at boot time. Those functions are weakly fed by random numbers from a non-initialized CSPRNG. To overcome this problem, we propose E-Boot, a novel technique that provides high-quality random numbers to guest virtual machines. E-Boot is the first technique that completely satisfies the entropy demand of virtualized boot-loaders and operating systems at boot time. We have implemented E-Boot in Linux v5.3 and our experiments show that it effectively solves the boot-time entropy starvation problem. Our proposal successfully feeds bootloaders and boot time Linux kernel hardening techniques with high-quality random numbers, reducing also to zero the number of userspace blocks and delays. The total time overhead introduced by E-Boot is around 2 μs and has zero memory overhead, since the memory is freed before the kernel boot ends, which makes E-boot a practical solution for cloud systems.https://ieeexplore.ieee.org/document/9050782/Cloudvirtualizationsecurityentropyboot-timeoperating systems |
| spellingShingle | Fernando Vano-Garcia Hector Marco-Gisbert E-BOOT: Preventing Boot-Time Entropy Starvation in Cloud Systems IEEE Access Cloud virtualization security entropy boot-time operating systems |
| title | E-BOOT: Preventing Boot-Time Entropy Starvation in Cloud Systems |
| title_full | E-BOOT: Preventing Boot-Time Entropy Starvation in Cloud Systems |
| title_fullStr | E-BOOT: Preventing Boot-Time Entropy Starvation in Cloud Systems |
| title_full_unstemmed | E-BOOT: Preventing Boot-Time Entropy Starvation in Cloud Systems |
| title_short | E-BOOT: Preventing Boot-Time Entropy Starvation in Cloud Systems |
| title_sort | e boot preventing boot time entropy starvation in cloud systems |
| topic | Cloud virtualization security entropy boot-time operating systems |
| url | https://ieeexplore.ieee.org/document/9050782/ |
| work_keys_str_mv | AT fernandovanogarcia ebootpreventingboottimeentropystarvationincloudsystems AT hectormarcogisbert ebootpreventingboottimeentropystarvationincloudsystems |