Protecting Co-resident VMs from Side-Channel Attack in Cloud Environment: SAFEPERIMETER System

摘要

Today, the use of Cloud Computing is constrained by its vulnerabilities, because sharing the same resources with potential attackers may breaks the isolation between VMs. Also, some studies demonstrated that cache-based side channel attacks can break full encryption keys of RSA, DES and AES. In this paper we investigate side channel attacks via shared memory caches that can break the isolation between Vms, and present our new system, which has been called SAFEPERIMETER, and which aims to mitigate such discussed attacks, in a special thread, like AES encryption. It consists on securing access to L3 cache by locking it line by line, for a special confidential thread, without assigning any locked cache line to any VM. We also present the idea of implementing this service on a particular Image Management System.