VM image Integrity Verification
Background:
More and more virtual machines are being used, especially under emerging of virtual cloud
computing. In order to manage all the images, the Mirage image format (MIF) is created and
deployed on our VCL. MIF uses image manifest to map each file, which means the images can
store in the mirage repository in unit of file, not image disk. And the operation can be done
directly on each file, not the disk file. However, it creates the new problem to verify the integrity
of new image which is checkout from the mirage storage. For instance, the order of each binary
file on the disk may be different. And the content of empty space of the disk file can be different.
These variables will not affect the integrity of the disk, but will generate different hash result if
simply hash the whole virtual disk file. Thus I design a new method which can verify the integrity
of files in the image and the integrity of several important metadata of the image file.
Concept:
In order to remain the integrity of image file, there are several characteristics in the image file
need to maintain the same in the image file. First, all the content in the file system should be the
same, including the file name, file content, path to the file, directory and access privilege for
directory and file. Second, image’s metadata can’t be changed, including UUID, version, CID, and
etc. (VMDK format for instance)
Method:
There are several types of virtual machine disk formats existing now, for instance, vdi, vmdk, img
and etc. For vmdk file alone, it has the 5 types, which are used for the different desktops’ and
servers’ architecture. In order to simply the implementation, I will assume that virtual machine
image format is vmdk type 0, and OS is linux on the virtual machine, and file system is ext3.
Figure 1
In order to verify the integrity of file system, I will use tool to mount the image to the trusted
machine, and hash each file in alphabetic sort-order (Figure 1), and the hash content includes
file name, content, path, access privilege (Figure 2) and etc. I also need to hash the directory,
including directory name, path and access privilege, even some directories are empty.
Figure 2
Then I have to hash some important components in the vmdk file, such as metadata (Figure 3),
superblock object and the dentry object. Because I use vmdk type 0 file, the metadata of image
is in the head of image content. The superblock object and the dentry object are also important
for the file system, but they may be hard to locate their position. After hashing these contents of
components, I can get the other hash result.
After getting the final two hashed results, I can hash the two hash results and get the one final
result. Then I can encrypt the result by the secret key, and store the result in somewhere. Then I
can check in the image into mirage store. When the user checkout the image, the user can use
the same method hash the image, then decrypt the original hashed result by my public key and
compare with his or her result. If the results are the same, the integrity can be guarantee.