Integrated Protection Mechanisms for Mitigating Microarchitectural Attacks in Cloud Computing
DOI:
https://doi.org/10.59992/IJCI.2024.v3n5p2الكلمات المفتاحية:
Cloud Computing، Flush+Reload، Flush+Flush، Microarchitectural Attacks، Prime + Probeالملخص
By utilising the multi-tenancy characteristic, cloud computing promises to reduce expenses through less spending on hardware, infrastructure, and software. Even with all of its advantages, multi-tenancy poses hazards for cloud computing. Without suitable cloud security solutions, security concerns might end up being the main factor delaying adoption. Additionally, multi-tenancy enabled by virtualisation, which is one of the key elements of a cloud, creates significant security vulnerabilities and does not provide adequate isolation between various instances running on the same physical system. The three strategies we suggest to secure shared virtualised systems against microarchitectural attacks are presented in this re- search as a comprehensive solution. This includes experiments for combining the three approaches and assessing them in potential operational contexts. The assessment techniques have used several host systems to assess the system overhead, CPU usage, and protection accuracy. The studies we have conducted on both Debian 10 and Ubuntu 18.04 LTS physical servers utilising the KVM hypervisor demonstrate that our comprehensive protection can identify attacks with about 97% accuracy, and depending on how many mechanisms were used in the various experimental scenario settings, the proportion of CPU consumption has varied significantly. The CPU usage rate in experiments with different scenarios has ranged from 27% to 68%, while the average system load over 5 minutes has ranged from 1.40 to 4.2. This shows our proposed mechanisms are subject to refinement and enhancement, especially in cases that require a high processing load. Note that if we had used servers with more computing power, the results would certainly have been better.
المراجع
[1] H. Takabi, J. B. Joshi, and G.-J. Ahn, “Security and privacy challenges in cloud computing environments,” IEEE Security & Privacy, vol. 8, no. 6, pp. 24–31, 2010.
[2] “Gartner identifies the top 10 strategic tech- nology trends for 2020.” [Online]. Avail- able: https://www.gartner.com/en/newsroom/press-releases/
2019-10-21-gartner-identifies-the-top-10-strategic-technology-trends-for-2020
[3] K. Hashizume, D. G. Rosado, E. Ferna´ndez-Medina, and E. B. Fernandez, “An analysis of security issues for cloud computing,” Journal of internet services and applications, vol. 4, no. 1, pp. 1– 13, 2013.
[4] H. Aljahdali, P. Townend, and J. Xu, “Enhancing multi-tenancy security in the cloud iaas model over public deployment,” in 2013 IEEE Seventh International Symposium on Service-Oriented System Engineering. IEEE, 2013, pp. 385–390.
[5] S. Saxena, G. Sanyal, S. Srivastava, and R. Amin, “Preventing from cross-vm side-channel attack using new replacement method,” Wire- less Personal Communications, vol. 97, no. 3, pp. 4827–4854, 2017.
[6] H. AlJahdali, A. Albatli, P. Garraghan, P. Townend, L. Lau, and J. Xu, “Multi-tenancy in cloud computing,” in 2014 IEEE 8th International Symposium on Service Oriented System Engineering. IEEE, 2014,
pp. 344–351.
[7] A. Albalawi, V. Vassilakis, and R. Calinescu, “Side-channel attacks and countermeasures in cloud services and infrastructures,” in NOMS 2022-2022 IEEE/IFIP Network Operations and Management Sympo- sium. IEEE, 2022, pp. 1–4.
[8] A. Donevski, S. Ristov, and M. Gusev, “Security assessment of virtual machines in open source clouds,” in 2013 36th International Conven- tion on Information and Communication Technology, Electronics and Microelectronics (MIPRO). IEEE, 2013, pp. 1094–1099.
[9] M.-M. Bazm, T. Sautereau, M. Lacoste, M. Sudholt, and J.-M. Menaud, “Cache-based side-channel attacks detection through intel cache monitoring technology and hardware performance counters,” in 3rd Int. Conf. on Fog and Mobile Edge Computing (FMEC), 2018, pp. 7–12.
[10] M. Chiappetta, E. Savas, and C. Yilmaz, “Real time detection of cache-based side-channel attacks using hardware performance coun- ters,” Applied Soft Computing, vol. 49, pp. 1162–1174, 2016.
[11] J. Cho, T. Kim, S. Kim, M. Im, T. Kim, and Y. Shin, “Real-time detection for cache side channel attack using performance counter monitor,” Applied Sciences, vol. 10, no. 3, p. 984, 2020.
[12] B. Gulmezoglu, A. Moghimi, T. Eisenbarth, and B. Sunar, “For- tuneteller: Predicting microarchitectural attacks via unsupervised deep learning,” arXiv preprint arXiv:1907.03651, 2019.
[13] M. Mushtaq, A. Akram, M. K. Bhatti, R. N. B. Rais, V. Lapotre, and
G. Gogniat, “Run-time detection of prime+ probe side-channel attack on aes encryption algorithm,” in Global Information Infrastructure and Networking Symp. (GIIS), 2018, pp. 1–5.
[14] T. Zhang, Y. Zhang, and R. B. Lee, “Cloudradar: A real-time side- channel attack detection system in clouds,” in Int. Symp. on Research in Attacks, Intrusions, and Defenses, 2016, pp. 118–140.
[15] H. Wang, H. Sayadi, S. Rafatirad, A. Sasan, and H. Homayoun, “Scarf: Detecting side-channel attacks at real-time using low-level hardware features,” in IEEE 26th Int. Symp. on On-Line Testing and Robust System Design (IOLTS), 2020, pp. 1–6.
[16] S. Anwar, Z. Inayat, M. F. Zolkipli, J. M. Zain, A. Gani, N. B. Anuar, M. K. Khan, and V. Chang, “Cross-vm cache-based side channel attacks and proposed prevention mechanisms: A survey,” Journal of Network and Computer Applications, vol. 93, pp. 259–279, 2017.
[17] G. Irazoqui, M. S. Inci, T. Eisenbarth, and B. Sunar, “Wait a minute! a fast, cross-vm attack on aes,” in International Workshop on Recent Advances in Intrusion Detection. Springer, 2014, pp. 299–319.
[18] P. Kocher, J. Horn, A. Fogh, D. Genkin, D. Gruss, W. Haas, M. Ham- burg, M. Lipp, S. Mangard, T. Prescher et al., “Spectre attacks: Ex- ploiting speculative execution,” in 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019, pp. 1–19.
[19] C. Tang, Z. Liu, C. Ma, J. Ge, and C. Tu, “Secflush: A hard- ware/software collaborative design for real-time detection and defense against flush-based cache attacks,” in International Conference on Information and Communications Security. Springer, 2019, pp. 251– 268.
[20] M. Lipp, M. Schwarz, D. Gruss, T. Prescher, W. Haas, A. Fogh,
J. Horn, S. Mangard, P. Kocher, D. Genkin et al., “Meltdown: Reading kernel memory from user space,” in 27th {USENIX} Security Symposium ({USENIX} Security 18), 2018, pp. 973–990.
[21] S. Bhattacharya and D. Mukhopadhyay, “Curious case of rowhammer: flipping secret exponent bits using timing analysis,” in International Conference on Cryptographic Hardware and Embedded Systems. Springer, 2016, pp. 602–624.
[22] G. Irazoqui, T. Eisenbarth, and B. Sunar, “Mascat: Stopping microar- chitectural attacks before execution.” IACR Cryptol. ePrint Arch., vol. 2016, p. 1196, 2016.
[23] ——, “Mascat: preventing microarchitectural attacks before distribu- tion,” in Proceedings of the Eighth ACM Conference on Data and Application Security and Privacy, 2018, pp. 377–388.
[24] “MFENCE - memory fence.” [Online]. Available: https://www. felixcloutier.com/x86/mfence
[25] “LFENCE — load fence.” [Online]. Available: https://www. felixcloutier.com/x86/lfence
[26] “CLFLUSH — flush cache line.” [Online]. Available: https:
//www.felixcloutier.com/x86/clflush
[27] “LOCK — assert lock signal prefix.” [Online]. Available: https:
//www.felixcloutier.com/x86/lock
[28] “MOVNTI — store doubleword using non-temporal hint.” [Online].
Available: https://www.felixcloutier.com/x86/movnti
[29] “MOVNTDQ — store packed integers using non-temporal hint.” [Online]. Available: https://www.felixcloutier.com/x86/movntdq
[30] Y. Yarom and K. Falkner, “Flush+ reload: a high resolution, low noise, l3 cache side-channel attack,” in 23rd {USENIX} Security Symposium ({USENIX} Security 14), 2014, pp. 719–732.
[31] D. Gruss, C. Maurice, K. Wagner, and S. Mangard, “Flush+ flush: a fast and stealthy cache attack,” in Int. Conf. on Detection of Intrusions and Malware, and Vulnerability Assessment, 2016, pp. 279–299.
[32] D. Philippe-Jankovic and T. A. Zia, “Breaking vm isolation-an in- depth look into the cross vm flush reload cache timing attack,” Int. J. of Computer Science and Network Security (IJCSNS), vol. 17, no. 2,
p. 181, 2017.
[33] Y. Zhang and M. K. Reiter, “Du¨ppel: retrofitting commodity operating systems to mitigate cache side channels in the cloud,” in Proceedings of the 2013 ACM SIGSAC conference on Computer & communica- tions security. ACM, 2013, pp. 827–838.
[34] B. C. Vattikonda, S. Das, and H. Shacham, “Eliminating fine grained timers in xen,” in Proceedings of the 3rd ACM workshop on Cloud computing security workshop. ACM, 2011, pp. 41–46.
[35] A. Albalawi, V. Vassilakis, and R. Calinescu, “Memory deduplication as a protective factor in virtualized systems,” in International Con- ference on Applied Cryptography and Network Security. Springer, 2021, pp. 301–317.
[36] A. Albalawi, V. G. Vassilakis, and R. Calinescu, “Protecting shared virtualized environments against cache side-channel attacks,” 2022.
[37] Y. Yarom, “Mastik: A micro-architectural side-channel toolkit,” https:
//cs.adelaide.edu.au/∼yval/Mastik/.
[38] X. Wang, J. Zhang, and A. Zhang, “Machine-learning-based malware detection for virtual machine by analyzing opcode sequence,” in Inter- National Conference on Brain Inspired Cognitive Systems. Springer, 2018, pp. 717–726.
[39] F. Liu, Y. Yarom, Q. Ge, G. Heiser, and R. B. Lee, “Last-level cache side-channel attacks are practical,” in 2015 IEEE Symposium on Security and Privacy. IEEE, 2015, pp. 605–622.
[40] Y. Han, J. Chan, T. Alpcan, and C. Leckie, “Virtual machine alloca- tion policies against co-resident attacks in cloud computing,” in 2014 IEEE International Conference on Communications (ICC). IEEE, 2014, pp. 786–792.
[41] ——, “Using virtual machine allocation policies to defend against co-resident attacks in cloud computing,” IEEE Transactions on De- pendable and Secure Computing, vol. 14, no. 1, pp. 95–108, 2015.
[42] J. Shi, X. Song, H. Chen, and B. Zang, “Limiting cache-based side- channel in multi-tenant cloud using dynamic page coloring,” in 2011 IEEE/IFIP 41st International Conference on Dependable Systems and Networks Workshops (DSN-W). IEEE, 2011, pp. 194–199.
[43] Y. Yarom, Q. Ge, F. Liu, R. B. Lee, and G. Heiser, “Mapping the intel last-level cache.” IACR Cryptology ePrint Archive, vol. 2015, p. 905, 2015.
[44] Albalawi, A., Vassilakis, V., & Calinescu, R. (2022, April). Side-channel attacks and countermeasures in cloud services and infrastructures. In NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium (pp. 1-4). IEEE.
