面向云计算平台的虚拟机同驻方法

doi:10.11959/j.issn.1000-436x.2018241

Abstract

Abstract:

If the attacker wants to compromise a target virtual machine on a cloud platform,the malicious virtual machine must be co-resident with the target.Based on this,a virtual machine co-residency method was proposed.The method combined a co-residency detection scheme based on covert channel construction and an automatic virtual machine flooding strategy,and was evaluated on a well-known domestic cloud platform.Experiment shows that the adaptive covert channel can achieve accuracies of 95%,the proposed detection scheme has strong robustness whose false positive rate is less than 5 ‰,the proposed method is versatile and keeps the virtualization isolation barrier intact,which has great potential threat and should be paid great attention and precaution.

Key words: cloud computing platform, virtual machine co-residency, covert channel,, virtual machine flooding

CLC Number:

TP309

Weijie LIU,Li’na WANG,Danlei WANG,Zhengguang YIN,Nan FU. Virtual machine co-residency method on cloud computing platform[J]. Journal on Communications, 2018, 39(11): 116-128.

Figures/Tables 12

References 32

[1]	DESNOS A , FILIOL E , LEFOU I ,et al. Detecting (and creating!) a HVM rootkit (aka BluePill-like)[J]. Journal in Computer Virology, 2011,7(1): 23-49.
[2]	RAZAVI K , GRAS B , BOSMAN E ,et al. Flip feng shui:hammering a needle in the software stack[C]// Usenix Security Symposium. 2016: 1-18.
[3]	XIAO Y , ZHANG X , ZHANG Y ,et al. One bit flips,one cloud flops:cross-VM row hammer attacks and privilege escalation[C]// Usenix Security Symposium. 2016: 19-35.
[4]	ZHANG T , ZHANG Y , LEE R . DoS attacks on your memory in the cloud[C]// ACM Symposium on Information,Computer and Communications Security. 2017: 253-265.
[5]	IRAZOQUI G , INCI M S , EISENBARTH T ,et al. Fine grain cross-VM attacks on Xen and VMware[C]// ACM Conference on Cloud Computing. 2014: 737-744.
[6]	IRAZOQUI G , INCI M S , EISENBARTH T ,et al. Wait a minute! a fast,cross-VM attack on AES[C]// International Symposium on Recent Advances in Intrusion Detection. 2014: 299-319.
[7]	LIU F , YAROM Y , GE Q ,et al. Last-level cache side-channel attacks are practical[C]// IEEE Symposium on Security and Privacy. 2015: 605-622.
[8]	IRAZOQUI G , EISENBARTH T , SUNAR B ,et al. Cross processor cache attacks[C]// ACM Conference on Computer and Communications Security. 2016: 353-364.
[9]	YAROM Y , GENKIN D , HENINGER N ,et al. CacheBleed:a timing attack on OpenSSL constant time RSA[C]// International Workshop on Cryptographic Hardware and Embedded Systems. 2016: 346-367.
[10]	RISTENPART T , TROMER E , SHACHAM H ,et al. Hey,you,get off of my cloud:exploring information leakage in third-party computeclouds[C]// ACM Conference on Computer and Communications Security. 2009: 199-212.
[11]	BATES A , MOOD B , PLETCHER J ,et al. Detecting co-residency with active traffic analysis techniques[C]// ACM Conference on Cloud Computing. 2012: 1-12.
[12]	XU Z , WANG H , WU Z ,et al. A measurement study on co-residence threat inside the cloud[C]// Usenix Security Symposium. 2015: 929-944.
[13]	王丽娜, 张浩, 余荣威 ,等. 基于 VPE 的可信虚拟域构建机制[J]. 通信学报, 2013,34(12): 167-177.
	WANG L N , ZHANG H , YU R W ,et al. Building mechanism of trusted virtual domain via the VPE[J]. Journal on Communications, 2013,34(12): 167-177.
[14]	ZHANG Y , JUELS A , OPREA A ,et al. HomeAlone:co-residency detection in the cloud via side-channel analysis[C]// IEEE Symposium on Security and Privacy. 2011: 313-328.
[15]	余思, 桂小林, 张学军 ,等. 云环境中基于 cache 共享的虚拟机同驻检测方法[J]. 计算机研究与发展, 2013,50(12): 2651-2660.
	YU S , GUI X L , ZHANG X J ,et al. Co-residency detection scheme based on shared cache in the cloud[J]. Journal of Computer Research and Development, 2013,50(12): 2651-2660.
[16]	LIU F , GE Q , YAROM Y ,et al. CATalyst:defeating last-level cache side channel attacks in cloud computing[C]// IEEE International Symposium on High Performance Computer Architecture. 2016: 406-418.
[17]	梁鑫, 桂小林, 戴慧珺 ,等. 云环境中跨虚拟机的 cache 侧信道攻击技术研究[J]. 计算机学报, 2017,40(2): 317-336.
	LIANG X , GUI X L , DAI H J ,et al. Cross-VM cache side channel attacks in cloud:a survey[J]. Chinese Journal of Computers, 2017,40(2): 317-336.
[18]	王国峰, 刘川意, 潘鹤中 ,等. 云计算模式内部威胁综述[J]. 计算机学报, 2017,40(2): 296-316.
	WANG G F , LIU C Y , PAN H Z ,et al. Survey on insider threats to cloud computing[J]. Chinese Journal of Computers, 2017,40(2): 296-316.
[19]	WANG L , LIU W , KUMAR N ,et al. A novel covert channel detection method in cloud based on XSRM and improved event association algorithm[J]. Security and Communication Networks, 2016,9(16): 3543-3557.
[20]	IRAZOQUI G , EISENBARTH T , SUNAR B ,et al. S$A:a shared cache attack that works across cores and defies VM sandboxing-and its application to AES[C]// IEEE Symposium on Security and Privacy. 2015: 591-604.
[21]	沈晴霓, 李卿 . 云计算环境中的虚拟机同驻安全问题综述[J]. 集成技术, 2015,4(5): 5-17.
	SHEN Q N , LI Q . Review on co-residency security issues of virtual machines in cloud computing[J]. Journal of Integration Technology, 2015,4(5): 5-17.
[22]	OSVIK D A , SHAMIR A , TROMER E . Cache attacks and countermeasures:the case of AES[C]// Cryptographers’ Track at the RSA Conference. 2006: 1-20.
[23]	YAROM Y , FALKNER K . FLUSH+RELOAD:a high resolution,low noise,L3 cache side-channel attack[C]// Usenix Security Symposium. 2014: 719-732.
[24]	MAURICE C , SCOUARNEC N L , NEUMANN C ,et al. Reverse engineering intel last-level cache complex addressing using performance counters[C]// International Symposium on Recent Advances in Intrusion Detection. 2015: 48-65.
[25]	IRAZOQUI G , EISENBARTH T , SUNAR B ,et al. Systematic reverse engineering of cache slice selection in intel processors[C]// Euromicro Conference on Digital Systems Design. 2015: 629-636.
[26]	WU Z , XU Z , WANG H ,et al. Whispers in the hyper-space:high-bandwidth and reliable covert channel attacks inside the cloud[J]. IEEE/ACM Transactions on Networking, 2015,23(2): 603-615.
[27]	PAAR C , PELZL J . Understanding cryptography:a textbook for students and practitioners[M]. Springer Science ＆ Business Media, 2009.
[28]	LI P , GAO D , REITER M K ,et al. Replica placement for availability in the worst case[C]// International Conference on Distributed Computing Systems. 2015: 599-608.
[29]	MOON S , SEKAR V , REITER M K ,et al. Nomad:mitigating arbitrary cloud side channels via provider-assisted migration[C]// ACM Conference on Computer and Communications Security. 2015: 1595-1606.
[30]	LIU W , GAO D , REITER M K . On-demand time blurring to support side-channel defense[C]// European Symposium on Research in Computer Security. 2017: 210-228.
[31]	NEEDLEMAN S B , WUNSCH C D . A general method applicable to the search for similarities in the amino acid sequence of two proteins[J]. Journal of Molecular Biology, 1970,48(3): 443-453.
[32]	VARADARAJAN V , ZHANG Y , RISTENPART T ,et al. A placement vulnerability study in multi-tenant public clouds[C]// Usenix Security Symposium. 2015: 913-928.

Metrics

Recommended 0

No Suggested Reading articles found!

参数	值
实际同驻对数	218
判断正确次数	217
误检率	4.6‰
实际不同驻对数	202
判断正确次数	202
漏检率	0%

账号	地域-可用区	实例类型	数量	同驻对数
甲	华南1-A	n₁.small	50	0
甲	华南1-A	n₂.small	50	0
甲	华南1-A	n₁.medium	50	0
甲	华南1-A	n₂.medium	50	0

账号	地域可用区	实例类型	数量	同驻对数
甲、乙	华南1-A	sn₁.medium	10	1
甲、乙、丙	华南1-A	sn₁.medium	15	2
甲、乙、丙、丁	华南1-A	sn₂.medium	120	35
甲、乙、丙、丁、戊	华南1-A	sn₂.medium	120	53
甲、乙、丙、丁、戊、己	华南1-A	sn₂.medium	120	59

实例类型	数量	平均同驻对数
n₁.tiny	12	2.46
sn₁.medium	12	2.88
sn₂.medium	12	2.62

Virtual machine co-residency method on cloud computing platform

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 12

References 32

Related Articles 13

Metrics

Recommended 0

[1]	Leixiao LI, Jinze DU, Hao LIN, Haoyu GAO, Yanyan YANG, Jing GAO. Research progress of blockchain network covert channel [J]. Journal on Communications, 2022, 43(9): 209-223.
[2]	Fenghua LI, Chaoyang LI, Chao GUO, Zifu LI, Liang FANG, Yunchuan GUO. Survey on key technologies of covert channel in ubiquitous network environment [J]. Journal on Communications, 2022, 43(4): 186-201.
[3]	Jiawen DIAO, Binxing FANG, Xiang CUI, Zhongru WANG, Ruiling GAN, Lin FENG, Hai JIANG. Survey of DNS covert channel [J]. Journal on Communications, 2021, 42(5): 164-178.
[4]	Meng ZHANG,Haoliang SUN,Peng YANG. Identification of DNS covert channel based on improved convolutional neural network [J]. Journal on Communications, 2020, 41(1): 169-179.
[5]	Yanfeng LI,Liping DING,Jingzheng WU,Qiang CUI,Xuehua LIU,Bei GUAN. Research on a new network covert channel model in blockchain environment [J]. Journal on Communications, 2019, 40(5): 67-78.
[6]	Feng-hua LI,Miao-miao TAN,Kai FAN,Kui GENG,Fu ZHAO. Network isolation communication scheme to resist against covert channel [J]. Journal on Communications, 2014, 35(11): 96-106.
[7]	. Network isolation communication scheme to resist against covert channel [J]. Journal on Communications, 2014, 35(11): 11-97.
[8]	. Detecting DNS-based covert channel on live traffic [J]. Journal on Communications, 2013, 34(5): 17-151.
[9]	Si-yu ZHANG,Fu-tai1 ZOU,Lu-hua WANG,Ming CHEN. Detecting DNS-based covert channel on live traffic [J]. Journal on Communications, 2013, 34(5): 143-151.
[10]	Jing-zheng WU,Li-ping Ding,Yong-ji WANG. Research on key problems of covert channel in cloud computing [J]. Journal on Communications, 2011, 32(9A): 184-203.
[11]	Yun-chuan GUO,Yuan ZHOU,Li DING,Li GUO. Simulation analysis of probabilistic covert channels based on probabilistic interference [J]. Journal on Communications, 2009, 30(2): 60-65.
[12]	Hai-tao ZENG,Yong-ji WANG,Li RUAN,Wei ZU,Jia-yong CAI. Covert channel mitigation method for secure real-time database using capacity metric [J]. Journal on Communications, 2008, 29(8): 47-57.
[13]	Zhi-dan YANG,Ke-sheng LIU,Yu CHEN,Jian-xiong CHEN. Random incremental ISN algorithm of protocol steganography against statistical steganalysis [J]. Journal on Communications, 2008, 29(11A): 34-40.