HomeAlone: Co-residency Detection in the Cloud via Side-Channel Analysis

Zhang, Yinqian; Juels, Ari; Oprea, Alina; Reiter, Michael K.

doi:10.1109/sp.2011.31

Cited by 272 publications

(165 citation statements)

References 33 publications

Supporting

Mentioning

165

Contrasting

Order By: Relevance

“…Bates et al [11] proposed a system where adversarial VMs introduce traffic congestion in host NICs, which is then detected by remote clients. Similarly, Zhang et al [6] designed HomeAlone, a system that detects VM placement by issuing side-channels in the L2 cache during periods of low traffic. Finally, Han et al [2] proposed VM placement strategies that defend against placement attacks, although they are not specifically geared towards public clouds.…”

Section: Related Workmentioning

confidence: 99%

Previously-Selected-Server-First based Scalable VM Placement Algorithm for Mitigating Side Channel Attacks in Cloud Computing

G¹,

Rao²,

Murthy³

2018

IJWMT

View full text Add to dashboard Cite

Pertaining to the rapid usage of cloud computing, cloud based approaches are growing as an fascinating domain for numerous malignant tasks. Security is one of the vital issues faced by the cloud computing environment while sharing resources over the internet. Consumers are facing distinct security hazards while using cloud computing platform. Previous works mainly attempted to mitigate the side channels attacks by altering the infrastructure and the internal procedures of the cloud stack. However, the deployments of these alterations are not so easy and could not resist the attacks. In this paper, the authors attempted to solve the issues by enhancing the VM Placement policies in such a way that, it is complex for the invaders to collocate their object. A secure Dynamic VM placement approach is presented for the VM allocations into different servers in the cloud. The performance comparison of the suggested methodology is shows that the proposed approach has better efficiency evaluations such as hit rate, loss rate and resource loss when compared to other V M placement policies.

show abstract

Section: Related Workmentioning

confidence: 99%

Previously-Selected-Server-First based Scalable VM Placement Algorithm for Mitigating Side Channel Attacks in Cloud Computing

G¹,

Rao²,

Murthy³

2018

IJWMT

View full text Add to dashboard Cite

show abstract

“…Their work for the first time opened the door for side channel attacks in the cloud setting. Two years later, Zhang et al used the cache as a tool to determine whether a user is co-located with someone else or not [52]. Just one year later, again Zhang et al managed to recover an ElGamal encryption key in a cloud scenario running XEN hypervisor when the adversary is co-located in the same core [53].…”

Section: Related Cache Side-channel Attacksmentioning

confidence: 99%

Know Thy Neighbor: Crypto Library Detection in Cloud

Irazoqui

İnci

Eisenbarth

et al. 2015

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Software updates and security patches have become a standard method to fix known and recently discovered security vulnerabilities in deployed software. In server applications, outdated cryptographic libraries allow adversaries to exploit weaknesses and launch attacks with significant security results. The proposed technique exploits leakages at the hardware level to first, determine if a specific cryptographic library is running inside (or not) a co-located virtual machine (VM) and second to discover the IP of the co-located target. Nevertheless, one of the main concerns that is slowing the widespread usage of such Infrastructure as a Service (IaaS) technologies are potential security vulnerabilities and privacy risks of cloud computing. Usually, CSPs employ virtual machines (VMs), allowing multiple tenants to share the same computing hardware. While this resource sharing maximizes utilization and hence drastically reduces cost, ensuring isolation of potentially sensitive data between VMs instantiated by different and untrusted tenants can be a challenge. Indeed, the main security principle in the design and implementation of virtual machine managers (VMMs) has been that of process and data isolation achieved through sandboxing. Although logical isolation ensures security at the software level, a malicious tenant might still extract private information due to leakage coming from side channels such as shared hardware resources. In short, hardware sharing create an opening for various side channel attacks developed for non-virtualized environments. These powerful attacks are capable of extracting sensitive information, e.g. passwords and private keys, by profiling the victim process. ignoring leakages of information through subtle side-channels shared by the processes running on the same physical hardware. In non-virtualized environments, a number of effective side-channel attacks were proposed that succeeded in extracting sensitive data by targeting the software layer only.

show abstract

“…According to the authors, Kelihos malware causes a memory explosion for few seconds, which is not a normal behavior for traditional applications. Zhang et al [52] use machine learning to deploy a lightweight mechanism in a VM to detect the behavior of L2 cache side channel attacks performed by other VMs.…”

Section: Related Workmentioning

confidence: 99%

CloudIDEA: A Malware Defense Architecture for Cloud Data Centers

Fischer

Kittel

Kolosnjaji

et al. 2015

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Due to the proliferation of cloud computing, cloud-based systems are becoming an increasingly attractive target for malware. In an Infrastructure-as-a-Service (IaaS) cloud, malware located in a customer's virtual machine (VM) affects not only this customer, but may also attack the cloud infrastructure and other co-hosted customers directly. This paper presents CloudIDEA, an architecture that provides a security service for malware defense in cloud environments. It combines lightweight intrusion monitoring with on-demand isolation, evidence collection, and in-depth analysis of VMs on dedicated analysis hosts. A dynamic decision engine makes on-demand decisions on how to handle suspicious events considering cost-efficiency and quality-of-service constraints.

show abstract

HomeAlone: Co-residency Detection in the Cloud via Side-Channel Analysis

Cited by 272 publications

References 33 publications

Previously-Selected-Server-First based Scalable VM Placement Algorithm for Mitigating Side Channel Attacks in Cloud Computing

Previously-Selected-Server-First based Scalable VM Placement Algorithm for Mitigating Side Channel Attacks in Cloud Computing

Know Thy Neighbor: Crypto Library Detection in Cloud

CloudIDEA: A Malware Defense Architecture for Cloud Data Centers

Contact Info

Product

Resources

About