Deploying a virtualized system is more than simply deploying a hypervisor; an entire solution for the installation and support of virtual images is required. A SBVD (Server-Based Virtual
Desktop) infrastructure is not a single product provided by a single vendor, but rather a
combination of multiple products from one or more vendors, which together provide the required solution.
Building and deploying a SBVD infrastructure requires the selection of the following components and features:
DRDC Ottawa CR 2011-135 39
x Hypervisor – The role of the hypervisor is to host the virtual infrastructure in a virtual environment that abstracts the hardware layer of the server, including storage and networking. . Besides a virtual environment for hosting of the virtual desktops, the hypervisor may support additional functions, such as virtual machine migration, which are controlled by a separate management console. The major products in this area are VMware ESX and vSphere, along with Citrix XenServer and Microsoft Hyper-V.
x Management console – The console enhances the hypervisor’s functionality of the virtual desktop environment, adding features such as high availability, distributed scheduling resources, and virtual machine migration. The console provides management of virtual machines throughout their lifecycle, including creation, configuration, and ongoing management (including features such as snapshot, rollback, backup, and export). Citrix XenCenter is the default management console for XenServer, however other consoles can be used that conform to the API, including OpenXenManager (a free open-source alternative to XenCenter).
x Desktop provisioning – The software provides support for provisioning, and distribution of virtual desktops to the users. The desktop provisioning tools include features such as policy control [Section 3.2.5], advanced virtual desktop image management, and connection protocol control. The provisioning software is normally installed on a dedicated server, and is compatible with the different hypervisors. The major products are VMware View Connection Server, Citrix XenDesktop Director, and Microsoft Med-V.
x Secure Access – This dedicated server will be located in the DMZ (De-Militarized Zone), and will manage secure access from the users to the virtual desktop infrastructure. Limiting remote connections to the DMZ and placing the secure access server in the DMZ, provides extra protection for the SBVD infrastructure. Secure access is provided by client software including Citrix ICA Client, Citrix XenDesktop, and VMware View.
x Template building – The software provides a graphical interface for building and managing the virtual desktop template library. Software such as VMware Studio or Citrix XenDesktop Studio provides this functionality. It is recommended that this software be installed on a dedicated server.
x Application virtualization delivery – A virtual application library is recommended in order to optimize the provisioning of the applications in a virtual desktop environment. This will act in coordination with the desktop provisioning tool and will virtualize the applications, providing them dynamically to the virtual desktop. This simplifies the application delivery, compatibility and update processes. Products include VMware ThinApp, Citrix XenApp, and Microsoft App-V.
x Offline streaming – The software controls the streaming and synchronization of the offline virtual desktops. It is normally installed on a dedicated server. Products include VMware View Transfer server. (Offline streaming is only part of the SBVD when offline operation is a requirement. The resulting system is not a pure SBVD solution.)
All of the components require specific security tools, and the design needs to consider the requirements for proper integration of these tools. They must be integrated with the existing virtualization architecture in order to deliver the virtual desktop environment to the end users. This integration must consider many critical factors, including the following:
40 DRDC Ottawa CR 2011-135
x Physical network – What access is required and what is the network bandwidth [Section 5.2];
x Security components – What security components are part of the system, for example firewalls and virus scanners;
x Printing environment – What are the printing requirements, is local printing permitted; x File server – Where are files stored, what access is required, can they be copied locally; and x Active Directory and identity management – What is the scheme for user authentication and
DRDC Ottawa CR 2011-135 41
7 Conclusion
This report provides an introduction to virtualization concepts, benefits, and security. Two approaches to desktop virtualization were described, both capable of satisfying the DND endpoint use case: LHVD and SBVD. Additional considerations for scalability, namely data centre
topology and bandwidth requirements have been provided, along with a brief background on a few specific state-of-the-art virtualization solutions.
Since specific requirements were not available, it is impossible to make detailed
recommendations. Instead, the conclusions are limited to the choice between Server-Based Virtual Desktop (SBVD) and Local Host Virtual Desktop (LHVD) solutions. SBVD places the user’s desktop in the data centre, versus LHVD that places the user’s desktop on the endpoint.
While both approaches have their advantages and disadvantages, SBVD has some clear
advantages over LHVD. Desktop environments are easier to update and provision since they run in the data centre. The fact that the desktop environment runs in the data centre also facilitates data backup, and reduces the likelihood of compromise of user data. Of course, this requires the security of the data centre be maintained, since failure to do so puts the data of many users at risk. From an isolation perspective, SBVD is favourable due to the fact that desktop environments of different security levels can be hosted on physically distinct hardware (within the data centre), while still accommodating a single endpoint for access to those environments.
While SBVD may be the preferred option, it may not be suitable for all users or for all working environments. Specifically, users engaged in computationally intense or graphically complex tasks will likely require a LHVD solution. Aside from these types of users, LHVD may also be the preferred option for constrained environments where network communications are insufficient or unreliable (e.g., for deployed users). It is necessary to consider the user experience when there are network limitations, including bandwidth and latency. Care should be taken when developing a LHVD solution to ensure the appropriate level of separation is provided for VMs running at different security levels.
This report does not provide specific recommendations or a preferred solution to the challenges of developing a virtualized DND endpoint. Before making recommendations, detailed requirements and use cases are needed for the endpoint. However, desktop virtualization technology can help to address the needs for information sharing within DND, specifically by enabling users to access, share, simultaneously view, and process data/information across security classifications from a single user interface using a single logon.
42 DRDC Ottawa CR 2011-135
8 References
[1] XENA Project Request for Information
[2] A. Magar, Virtualization Architectures Research Report, Version 1.0, ITSRD-0809-04, 13 March 2009.
[3] David Grawrock, Dynamics of a Trusted Platform: A Building Block Approach, Intel Press, April 2009.
[4] Trusted Computing Group, Trusted Platform Module,
http://www.trustedcomputinggroup.org/developers/trusted_platform_module/, accessed July 2011.
[5] Joanna Rutkowska, Rafal Wojtczuk, Qubes OS Architecture, Version 0.3, January 2010.
[6] Common Criteria for Information Technology Security Evaluation,
http://www.commoncriteriaportal.org/, accessed July 2011.
[7] Charpentier, R.; Carbone, R., Free and Open Source Software: Overview and Preliminary Guidelines for the Government of Canada (Logiciels libres et ouverts: Survol et guide préliminaire pour le gouvernement canadien), Defence R&D Canada - Valcartier, Valcartier QUE (CAN), DRDC-VALCARTIER-ECR-2004-232, External Client Report, September 2004.
[8] Wikipedia, Comparison of open source and closed source,
http://en.wikipedia.org/wiki/Comparison_of_open_source_and_closed_source, accessed July 2011.
[9] SELinux Project Wiki, http://selinuxproject.org/page/Main_Page, accessed July 2011.
[10] DMTF, Cloud Management Standards, http://www.dmtf.org/standards/cloud, accessed July 2011.
DRDC Ottawa CR 2011-135 43
9 Acronyms & Abbreviations
API Application Programming Interface BIOS Basic Input/Output System
C2 Command and Control
CDROM Compact Disk Read Only Memory CPU Central Processing Unit
CVP Client Virtualization Platform DMTF Distributed Management Task Force DMZ De-Militarized Zone
DND Department of National Defence DVD Digital Video Disc
EAL Evaluation Assurance Level GPO Group Policy Object IDS Intrusion Detection System IP Internet Protocol IT Information Technology
JIMP Joint, Interagency, Multinational and Public KVM Kernel Virtual Machine
LHVD Local Host Virtual Desktop MAC Media Access Control MCS Multi Caveat Separation MLS Multi Level Separation NAT Network Address Translation OS Operating System RAM Random Access Memory SBVD Server-Based Virtual Desktop SELinux Security Enhanced Linux SSL Secure Sockets Layer SSO Single Sign-On
TCP Transmission Control Protocol TLS Transport Layer Security TPM Trusted Platform Module USB Universal Serial Bus
UUID Universally Unique Identifier VDI Virtual Desktop Infrastructure VM Virtual Machine
VMM Virtual Machine Monitor
44 DRDC Ottawa CR 2011-135
This page intentionally left blank.
DOCUMENT CONTROL DATA
(Security classification of title, body of abstract and indexing annotation must be entered when the overall document is classified) 1. ORIGINATOR (The name and address of the organization preparing the document.
Organizations for whom the document was prepared, e.g. Centre sponsoring a contractor's report, or tasking agency, are entered in section 8.)
Bell Canada
160 Elgin Street, 17th Floor, Ottawa, ON, K2P 2C4
2. SECURITY CLASSIFICATION
(Overall security classification of the document including special warning terms if applicable.) UNCLASSIFIED
3. TITLE (The complete document title as indicated on the title page. Its classification should be indicated by the appropriate abbreviation (S, C or U) in parentheses after the title.)
The virtual desktop: Options and considerations in selecting a secure desktop infrastructure based on virtualization
4. AUTHORS (last name, followed by initials – ranks, titles, etc. not to be used) Durand, S.; Pase, W.
5. DATE OF PUBLICATION
(Month and year of publication of document.) October 2011
6a. NO. OF PAGES (Total containing information, including Annexes, Appendices, etc.)
5
6b. NO. OF REFS (Total cited in document.)
10
7. DESCRIPTIVE NOTES (The category of the document, e.g. technical report, technical note or memorandum. If appropriate, enter the type of report, e.g. interim, progress, summary, annual or final. Give the inclusive dates when a specific reporting period is covered.)
Contract Report
8. SPONSORING ACTIVITY (The name of the department project office or laboratory sponsoring the research and development – include address.) Defence R&D Canada – Ottawa
3701 Carling Avenue, Ottawa, ON, K1A 0Z4
9a. PROJECT OR GRANT NO. (If appropriate, the applicable research and development project or grant number under which the document was written. Please specify whether project or grant.)
15bs
9b. CONTRACT NO. (If appropriate, the applicable number under which the document was written.)
W7714-08FE01
10a. ORIGINATOR'S DOCUMENT NUMBER (The official document number by which the document is identified by the originating activity. This number must be unique to this document.) DRDC Ottawa CR 2011-135
10b. OTHER DOCUMENT NO(s). (Any other numbers which may be assigned this document either by the originator or by the sponsor.)
11. DOCUMENT AVAILABILITY (Any limitations on further dissemination of the document, other than those imposed by security classification.) Unlimited Distribution
12. DOCUMENT ANNOUNCEMENT (Any limitation to the bibliographic announcement of this document. This will normally correspond to the Document Availability (11). However, where further distribution (beyond the audience specified in (11) is possible, a wider announcement audience may be selected.))
13. ABSTRACT (A brief and factual summary of the document. It may also appear elsewhere in the body of the document itself. It is highly desirable that the abstract of classified documents be unclassified. Each paragraph of the abstract shall begin with an indication of the security classification of the information in the paragraph (unless the document itself is unclassified) represented as (S), (C), (R), or (U). It is not necessary to include here abstracts in both official languages unless the text is bilingual.)
Desktop virtualization technology can help to address the requirements for secure information sharing within DND. This report provides guidance for the selection and implementation of a secure desktop infrastructure based on virtualization. It includes an overview of desktop virtualization, including an in-depth examination of two alternative architectures: Local Host Virtual Desktop (LHVD) and Server-Based Virtual Desktop (SBVD). SBVD places the user’s desktop environment in the data centre, whereas LHVD places it on the endpoint itself. Desktop virtualization implementation considerations and potential security concerns are discussed, and an outline of some of the current state-of-the-art virtualization products is also provided.
14. KEYWORDS, DESCRIPTORS or IDENTIFIERS (Technically meaningful terms or short phrases that characterize a document and could be helpful in cataloguing the document. They should be selected so that no security classification is required. Identifiers, such as equipment model designation, trade name, military project code name, geographic location may also be included. If possible keywords should be selected from a published thesaurus, e.g. Thesaurus of Engineering and Scientific Terms (TEST) and that thesaurus identified. If it is not possible to select indexing terms which are Unclassified, the classification of each should be indicated as with the title.)