Abstract:Virtualization is the cornerstone of the developing third-party compute industry, allowing cloud providers to instantiate multiple virtual machines (VMs) on a single set of physical resources. Customers utilize cloud resources alongside unknown and untrusted parties, creating the co-resident threat—unless perfect isolation is provided by the virtual hypervisor, there exists the possibility for unauthorized access to sensitive customer information through the exploitation of covert side channels. This paper presents co-resident watermarking, a traffic analysis attack that allows a malicious co-resident VM to inject a watermark signature into the network flow of a target instance. This watermark can be used to exfiltrate and broadcast co-residency data from the physical machine, compromising isolation without reliance on internal side channels. As a result, our approach is difficult to defend against without costly underutilization of the physical machine. We evaluate co-resident watermarkingunder a large variety of conditions, system loads and hardware configurations, from a local laboratory environment to production cloud environments (Futuregrid and the University of Oregon’s ACISS). We demonstrate the ability to initiate a covert channel of 4 bits per second, and we can confirm co-residency with a target VM instance in <\documentclass[12pt]{minimal}\usepackage{amsmath}\usepackage{wasysym}\usepackage{amsfonts}\usepackage{amssymb}\usepackage{amsbsy}\usepackage{mathrsfs}\usepackage{upgreek}\setlength{\oddsidemargin}{-69pt}\begin{document}$$<$$\end{document}10 s. We also show that passive load measurement of the target and subsequent behavior profiling is possible with this attack. We go on to consider the detectability of co-resident watermarking, extending our scheme to create a subtler watermarking attack by imitating legitimate cloud customer behavior. Our investigation demonstrates the need for the careful design of hardware to be used in the cloud.

A Secure Virtual Machine Deployment Strategy to Reduce Co-residency in Cloud

A Virtual Machine Migration Strategy Based on the Relevance of Services Against Side-Channel Attacks

Review on Co-residency Security Issues of Virtual Machines in Cloud Computing

Defending against Co-residence Attack in Energy-Efficient Cloud: An Optimization based Real-time Secure VM Allocation Strategy

A Service Relevance Based Virtual Machine Migration Strategy in Cloud.

Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

Secure Virtual Machine Placement and Load Balancing Algorithms with High Efficiency.

A Load Balancing Strategy Based on Data Correlation in Cloud Computing

An Improved Co-Resident Attack Defense Strategy Based on Multi-Level Tenant Classification in Public Cloud Platforms

An SRN-Based Model for Assessing Co-Resident Attack Mitigation in Cloud with VM Migration and Allocation Policies*

A Placement Vulnerability Study in Multi-tenant Public Clouds

Smart VM Co-Scheduling with the Precise Prediction of Performance Characteristics

Interdependency Attack-Aware Secure and Performant Virtual Machine Allocation Policies With Low Attack Efficiency and Coverage

Agent-Based Virtual Machine Migration for Load Balancing and Co-Resident Attack in Cloud Computing

Affinity and Conflict-Aware Placement of Virtual Machines in Heterogeneous Data Centers.

Multilateral Security Architecture for Virtualization Platform in Multi-Tenancy Cloud Environment

Repttack: Exploiting Cloud Schedulers to Guide Co-Location Attacks

SeLance: Secure Load Balancing of Virtual Machines in Cloud

On detecting co-resident cloud instances using network flow watermarking techniques

Smart-DRS: A Strategy of Dynamic Resource Scheduling in Cloud Data Center

Two Optimization Mechanisms to Improve the Isolation Property of Server Consolidation in Virtualized Multi-core Server.