E-BOOT: preventing boot-time entropy starvation in cloud systems

Fernando Vano-García*, Hector Marco-Gisbert

*Corresponding author for this work

Research output: Contribution to journalArticle

26 Downloads (Pure)

Abstract

Due to the impracticability of generating true randomness by running deterministic algorithms in computers, boot-loaders and operating systems undergo the lack of enough supplies of entropy at boot-time. This problem remains a challenge and affects all computer systems, including virtualization technologies. Unfortunately, this situation leads to undesired side effects, affecting the security of important kernel components and causing large blocking waits in the start-up of userland processes. For example, SSHD
is delayed up to 4 minutes. In this paper, we analyze the boot-time entropy starvation problem, performing a comprehensive analysis of the Linux kernel boot process revealing that the problem not only affects userland applications but up to 33 kernel functions at boot time. Those functions are weakly fed by random numbers from a non-initialized CSPRNG. To overcome this problem, we propose E-Boot, a novel technique that provides high-quality random numbers to guest virtual machines. E-Boot is the first technique that
completely satisfies the entropy demand of virtualized boot-loaders and operating systems at boot time. We have implemented E-Boot in Linux v5.3 and our experiments show that it effectively solves the boottime entropy starvation problem. Our proposal successfully feeds bootloaders and boot time Linux kernel hardening techniques with high-quality random numbers, reducing also to zero the number of userspace blocks and delays. The total time overhead introduced by E-Boot is around 2 µs and has zero memory overhead, since the memory is freed before the kernel boot ends, which makes E-boot a practical solution
for cloud systems.
Original languageEnglish
Article number9050782
Pages (from-to)61872-61890
Number of pages19
JournalIEEE Access
Volume8
DOIs
Publication statusPublished - 30 Mar 2020

    Fingerprint

Keywords

  • Cloud
  • Virtualization
  • Security
  • Entropy
  • Boot-time
  • Operating Systems

Cite this