Duppel: Retrofitting Commodity Operating Systems to Mitigate Cache Side Channels in the Cloud

摘要

This paper presents the design, implementation and evaluation of a system called Duppel that enables a tenant virtual machine to defend itself from cache-based side-channel attacks in public clouds. Duppel includes defenses for timeshared caches such as per-core L1 and L2 caches. Experiments in the lab and on public clouds show that Duppel effectively obfuscates timing signals available to an attacker VM via these caches and incurs modest performance overheads (at most 7% and usually much less) in the common case of no side-channel attacks. Moreover, Duppel requires no changes to hypervisors or support from cloud operators.