Abstract:Virtualization is the cornerstone of the developing third-party compute industry, allowing cloud providers to instantiate multiple virtual machines (VMs) on a single set of physical resources. Customers utilize cloud resources alongside unknown and untrusted parties, creating the co-resident threat—unless perfect isolation is provided by the virtual hypervisor, there exists the possibility for unauthorized access to sensitive customer information through the exploitation of covert side channels. This paper presents co-resident watermarking, a traffic analysis attack that allows a malicious co-resident VM to inject a watermark signature into the network flow of a target instance. This watermark can be used to exfiltrate and broadcast co-residency data from the physical machine, compromising isolation without reliance on internal side channels. As a result, our approach is difficult to defend against without costly underutilization of the physical machine. We evaluate co-resident watermarkingunder a large variety of conditions, system loads and hardware configurations, from a local laboratory environment to production cloud environments (Futuregrid and the University of Oregon’s ACISS). We demonstrate the ability to initiate a covert channel of 4 bits per second, and we can confirm co-residency with a target VM instance in <\documentclass[12pt]{minimal}\usepackage{amsmath}\usepackage{wasysym}\usepackage{amsfonts}\usepackage{amssymb}\usepackage{amsbsy}\usepackage{mathrsfs}\usepackage{upgreek}\setlength{\oddsidemargin}{-69pt}\begin{document}$$<$$\end{document}10 s. We also show that passive load measurement of the target and subsequent behavior profiling is possible with this attack. We go on to consider the detectability of co-resident watermarking, extending our scheme to create a subtler watermarking attack by imitating legitimate cloud customer behavior. Our investigation demonstrates the need for the careful design of hardware to be used in the cloud.

Detecting VMs Co-residency in Cloud: Using Cache-based Side Channel Attacks

A Virtual Machine Migration Strategy Based on the Relevance of Services Against Side-Channel Attacks

Virtual Mac Spoofing Detection Through Deep Learning

A Secure Virtual Machine Deployment Strategy to Reduce Co-residency in Cloud

A Shared Memory Based Cross-Vm Side Channel Attacks In Iaas Cloud

On detecting co-resident cloud instances using network flow watermarking techniques

A Placement Vulnerability Study in Multi-tenant Public Clouds

Defending against Co-residence Attack in Energy-Efficient Cloud: An Optimization based Real-time Secure VM Allocation Strategy

Smart VM Co-Scheduling with the Precise Prediction of Performance Characteristics

Locality Based Cache Side-channel Attack Detection

An Improved Co-Resident Attack Defense Strategy Based on Multi-Level Tenant Classification in Public Cloud Platforms

Secure Virtual Machine Placement and Load Balancing Algorithms with High Efficiency.

Investigating Timing Channel in IaaS

Review on Co-residency Security Issues of Virtual Machines in Cloud Computing

Volcano: Stateless Cache Side-channel Attack by Exploiting Mesh Interconnect

MDCD: A malware detection approach in cloud using deep learning

Precise Contention-Aware Performance Prediction on Virtualized Multicore System.

Detection of Information leakage in cloud

Cross-Tenant Side-Channel Attacks in PaaS Clouds

An SRN-Based Model for Assessing Co-Resident Attack Mitigation in Cloud with VM Migration and Allocation Policies*

Repttack: Exploiting Cloud Schedulers to Guide Co-Location Attacks