XenPump: A new method to mitigate timing channel in cloud computing

Proceedings - 2012 IEEE 5th International Conference on Cloud Computing, CLOUD 2012

Volumn , Issue , 2012, Pages 678-685

  Wu, Jingzheng ^a,b   Ding, Liping ^a   Lin, Yuqi ^a,b   Min Allah, Nasro ^c   Wang, Yongji ^a  

^a INSTITUTE OF SOFTWARE   (China)

^b UNIVERSITY OF CHINESE ACADEMY OF SCIENCES   (China)

^c Department of Electrical Computer Engineering   (Pakistan)

Author keywords

cloud computing; information flow; mitigation; Timing channel; virtualization; Xen

Indexed keywords

INFORMATION FLOWS; MITIGATION; TIMING CHANNELS; VIRTUALIZATIONS; XEN;

SECURITY OF DATA; VIRTUAL REALITY;

CLOUD COMPUTING;

EID: 84866768367     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/CLOUD.2012.28     Document Type: Conference Paper

References (37)

1. D. Zhang, A. Askarov, and A. C. Myers, "Predictive mitigation of timing channels in interactive systems," in Proceedings of the 18th ACM conference on Computer and communications security, ser. CCS '11. New York, NY, USA: ACM, 2011, pp. 563-574.
2. Y. Xu, M. Bailey, F. Jahanian, K. Joshi, M. Hiltunen, and R. Schlichting, "An exploration of l2 cache covert channels in virtualized environments," in Proceedings of the 3rd ACM workshop on Cloud computing security workshop, ser. CCSW '11. New York, NY, USA: ACM, 2011, pp. 29-40.
3. A. O. Yinqian Zhang, Ari Juels and M. K. Reiter, "Homealone: Co-residency detection in the cloud via side-channel analysis," in IEEE Symposium on Security and Privacy, Oakland, California, 2011, pp. 313-328.
4. H. Takabi, J. B. D. Joshi, and G.-J. Ahn, "Security and privacy challenges in cloud computing environments," IEEE Security & Privacy, vol. 8, no. 6, pp. 24-31, 2010.
5. J. Wu, L. Ding, Y. Wang, and W. Han, "Identification and evaluation of sharing memory covert timing channel in Xen virtual machines," in IEEE CLOUD, Washington DC, USA, 2011, pp. 283-291.
6. J. Wu, L. Ding, and Y. Wang, "Research on key problems of covert channel in cloud computing," Journal of Communications, vol. 32, no. 9A, pp. 184 - 203, 2011.
7. A. Aviram, S. Hu, B. Ford, and R. Gummadi, "Determinating timing channels in compute clouds," in CCSW '10: Proceedings of the 2010 ACM workshop on Cloud computing security workshop. New York, NY, USA: ACM, 2010, pp. 103-108.
8. Y. Wang, J. Wu, H. Zeng, L. Ding, and X. Liao, "Covert channel research," Journal of Software, vol. 21, no. 9, pp. 2262-2288, 2010.
9. S. Zander, G. J. Armitage, and P. Branch, "A survey of covert channels and countermeasures in computer network protocols," IEEE Communications Surveys and Tutorials, vol. 9, no. 1-4, pp. 44-57, 2007.
10. B. W. Lampson, "A note on the confinement problem," Commun. ACM, vol. 16, no. 10, pp. 613-615, 1973.
11. J. Wu, L. Ding, Y. Wang, and W. Han, "A practical covert channel identification approach in source code based on directed information flow graph," in IEEE SSIRI, Jeju Island, Korea, 2011, pp. 98-107.
12. J. Wu, Y. Wang, L. Ding, and Y. Zhang, "Constructing scenario of event-flag covert channel in secure operating system," in ICIMT, Hongkong, 2010, pp. 371-375.
13. H. Zeng, Y. Wang, L. Ruan, W. Zu, and J. Cai, "Covert channel mitigation method. for secure real-time database using capacity metric," Journal on Communications, vol. 29, no. 8, pp. 46-56, 2008.
14. Y. Wang, J. Wu, L. Ding, and H. Zeng, "Detecion approach for covert channel based concurrency conflict interval time," Journal of Computer Research and Development, vol. 48, no. 8, pp. 1542-1553, 2011.
15. S. Cabuk, C. E. Brodley, and C. Shields, "IP covert timing channels: design and detection," in ACM Conference on Computer and Communications Security, 2004, pp. 178-187.
16. J. Wu, Y. Wang, L. Ding, and X. Liao, "Improving performance of network covert timing channel through huffman coding," Mathematical and Computer Modelling, vol. 55, no. 1-2, pp. 69 - 79, 2012.
17. T. Ristenpart, E. Tromer, H. Shacham, and S. Savage, "Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds," in ACM Conference on Computer and Communications Security, 2009, pp. 199-212.
18. K. Okamura and Y. Oyama, "Load-based covert channels between Xen virtual machines," in SAC, 2010, pp. 173-180.
19. Z. Wang and X. Jiang, "Hypersafe: A lightweight approach to provide lifetime hypervisor control-flow integrity," in IEEE Symposium on Security and Privacy, 2010, pp. 380-395.
20. B. D. Payne, R. Sailer, R. Cáceres, R. Perez, and W. Lee, "A layered approach to simplified access control in virtualized systems," Operating Systems Review, vol. 41, no. 4, pp. 12-19, 2007.
21. R. Sailer, T. Jaeger, E. Valdez, R. Cáceres, R. Perez, S. Berger, J. L. Griffin, and L. van Doorn, "Building a mac-based security architecture for the XenXen open-source hypervisor," in ACSAC, 2005, pp. 276-285.
22. P. Barham, B. Dragovic, K. Fraser, S. Hand, T. L. Harris, A. Ho, R. Neugebauer, I. Pratt, and A. Warfield, "Xen and the art of virtualization," in SOSP, 2003, pp. 164-177.
23. B. D. Payne, M. Carbone, M. I. Sharif, and W. Lee, "Lares: An architecture for secure active monitoring using virtualization," in IEEE Symposium on Security and Privacy, 2008, pp. 233-247.
24. A. M. Azab, P. Ning, Z. Wang, X. Jiang, X. Zhang, and N. C. Skalsky, "Hypersentry: enabling stealthy in-context measurement of hypervisor integrity," in ACM Conference on Computer and Communications Security, 2010, pp. 38-49.
25. S. T. Jones, A. C. Arpaci-Dusseau, and R. H. Arpaci-Dusseau, "Antfarm: Tracking processes in a virtual machine environment," in USENIX Annual Technical Conference, General Track, 2006, pp. 1-14.
26. A. M. Azab, P. Ning, E. C. Sezer, and X. Zhang, "Hima: A hypervisor-based integrity measurement agent," in ACSAC, 2009, pp. 461-470.
27. J. Son and J. Alves-Foss, "A formal framework for real-time information flow analysis," Comput. Secur., vol. 28, no. 6, pp. 421-432, 2009.
28. D. Chisnall, The definitive guide to the Xen hypervisor. Prentice Hall Press, 2007.
29. NCSC, "Trusted computer system evaluation criteria (orange book)," 1985.
30. ISO/IEC, "Common criteria for information technology security evaluation," 2005.
31. E. S. Ristad and P. N. Yianilos, "Learning string-edit distance," IEEE Trans. Pattern Anal. Mach. Intell., vol. 20, no. 5, pp. 522-532, 1998.
32. M. H. Kang and I. S. Moskowitz, "A pump for rapid, reliable, secure communication," in ACM Conference on Computer and Communications Security, 1993, pp. 119-129.
33. M. H. Kang, I. S. Moskowitz, and D. C. Lee, "A network pump," IEEE Trans. Software Eng., vol. 22, no. 5, pp. 329-338, 1996.
34. M. Kang, I. Moskowitz, and D. Lee, "A network version of the pump," in Security and Privacy, 1995. Proceedings., 1995 IEEE Symposium on, 1995, pp. 144 -154.
35. M. Kang, I. Moskowitz, and S. Chincheck, "The pump: a decade of covert fun," in Computer Security Applications Conference, 21st Annual, 2005, pp. 352-360.
36. W.-M. Hu, "Reducing timing channels with fuzzy time," in IEEE Symposium on Security and Privacy, 1991, pp. 8-20.
37. A. Askarov, D. Zhang, and A. C. Myers, "Predictive blackbox mitigation of timing channels," in ACM Conference on Computer and Communications Security, 2010, pp. 297-307.