Using Virtual Machine Allocation Policies to Defend against Co-Resident Attacks in Cloud Computing

IEEE Transactions on Dependable and Secure Computing

Volumn 14, Issue 1, 2017, Pages 95-108

  Han, Yi ^a   Chan, Jeffrey ^b   Alpcan, Tansu ^a   Leckie, Christopher ^a  

^a UNIVERSITY OF MELBOURNE   (Australia)

^b RMIT UNIVERSITY   (Australia)

Author keywords

Cloud computing security; co resident attack; security metrics modelling; virtual machine allocation policy

Indexed keywords

CLOUD COMPUTING; NETWORK SECURITY; VIRTUAL MACHINE;

CLOUD COMPUTING PLATFORMS; CLOUD COMPUTING SECURITIES; LOW-POWER CONSUMPTION; OPEN SOURCE PLATFORMS; PRIVATE INFORMATION; SECURITY METRICS; VIRTUAL MACHINE ALLOCATIONS; WORKLOAD BALANCE;

SIDE CHANNEL ATTACK;

EID: 85020270849     PISSN: 15455971     EISSN: 19410018     Source Type: Journal    
DOI: 10.1109/TDSC.2015.2429132     Document Type: Article

References (48)

1. T. Ristenpart, E. Tromer, H. Shacham, and S. Savage, "Hey, you, get off of my cloud: Exploring information leakage in third-party compute clouds," in Proc. 16th ACM Conf. Comput. Commun. Security, 2009, pp. 199-212.
2. Y. Zhang, A. Juels, M. Reiter, and T. Ristenpart, "Cross-VM side channels and their use to extract private keys," in Proc. 19th ACM Conf. Comput. Commun. Security, 2012, pp. 305-316.
3. B. Vattikonda, S. Das, and H. Shacham, "Eliminating fine grained timers in xen," in Proc. 3rd ACM Workshop Cloud Comput. Security Workshop, 2011, pp. 41-46.
4. J. Wu, L. Ding, Y. Lin, N. Min Allah, and Y. Wang, "XenPump: A new method to mitigate timing channel in cloud computing," in Proc. 5th IEEE Int. Conf. Cloud Comput., 2012, pp. 678-685.
5. A. Aviram, S. Hu, B. Ford, and R. Gummadi, "Determinating timing channels in compute clouds," in Proc. ACM Workshop Cloud Comput. Security Workshop, 2010, pp. 103-108.
6. J. Shi, J. Shi, X. Song, H. Chen, and B. Zang, "Limiting Cachebased side-channel in multi-tenant cloud using dynamic page coloring," in Proc. 41st Annu. IEEE/IFIP Int. Conf. Dependable Syst. Netw. Workshops, 2011, pp. 194-199.
7. Y. Han, J. Chan, T. Alpcan, and C. Leckie, "Virtual machine allocation policies against co-resident attacks in cloud computing," in Proc. IEEE Int. Conf. Commun., 2014, pp. 786-792.
8. J. M. Kaplan, W. Forrest, and N. Kindler, "Revolutionizing data center energy efficiency," McKinsey & Company, 2008, http://www.mckinsey.com/clientservice/bto/pointofview/pdf/revolutionizing datacenterefficiency.pdf
9. A. Hameed, A. Khoshkbarforoushha, R. Ranjan, P. Jayaraman, J. Kolodziej, P. Balaji, S. Zeadally, Q. Malluhi, N. Tziritas, A. Vishnu, S. Khan, and A. Zomaya, "A survey and taxonomy on energy efficient resource allocation techniques for cloud computing systems," Computing, pp. 1-24, 2014, Doi: 10.1007/s00607-014-0407-8.
10. P. Graubner, "Energy-efficient management of virtual machines in eucalyptus," in Proc. 4th IEEE Int. Conf. Cloud Comput., 2011, pp. 243-250.
11. R. Jansen and P. R. Brenner, "Energy efficient virtual machine allocation in the coud: An analysis of cloud allocation policies," in Proc. Int. Green Comput. Conf. Workshops, 2011, pp. 1-8.
12. K. Le, R. Bianchini, J. Zhang, Y. Jaluria, J. Meng, and T. D. Nguyen, "Reducing electricity cost through virtual machine placement in high performance computing clouds," in Proc. Int. Conf. High Perform. Comput., Netw., Storage Anal., 2011, pp. 1-12.
13. K. Mills, J. Filliben, and C. Dabrowski, "Comparing VM-placement algorithms for on-demand clouds," in Proc. 3rd IEEE Int. Conf. Cloud Comput. Technol. Sci., 2011, pp. 91-98.
14. A. Beloglazov, J. Abawajy, and R. Buyya, "Energy-aware resource allocation heuristics for efficient management of data centers for cloud computing," Future Gener. Comput. Syst., vol. 28, no. 5, pp. 755-768, 2012.
15. CloudSim [Online]. Available: Http://www.cloudbus.org/cloudsim/, 2009.
16. R. Calheiros, R. Ranjan, A. Beloglazov, C. A. F. De Rose, and R. Buyya, "CloudSim: A toolkit for modeling and simulation of cloud computing environments and evaluation of resource provisioning algorithms," Softw., Practice Experience, vol. 41, no. 1, pp. 23-50, 2011.
17. OpenStack [Online]. Available: Http://www.openstack.org/, 2010.
18. F. F. Zhou, M. Goel, P. Desnoyers, and R. Sundaram, "Scheduler vulnerabilities and coordinated attacks in cloud computing," in Proc. 10th IEEE Int. Symp. Netw. Comput. Appl., 2011, pp. 123-130.
19. V. Varadarajan, T. Kooburat, B. Farley, T. Ristenpart, and M. Swift, "Resource-freeing attacks: Improve your cloud performance (at your neighbor's expense)," in Proc. ACM Conf. Comput. Commun. Security, 2012, pp. 281-292.
20. Z. Yang, Z. Yang, H. Fang, Y. Wu, C. Li, B. Zhao, and H. H. Huang, "Understanding the effects of hypervisor i/o scheduling for virtual machine performance interference," in Proc. 4th IEEE Int. Conf. Cloud Comput. Technol. Sci., 2012, pp. 34-41.
21. Amazon Elastic Compute Cloud (EC2) [Online]. Available: Http://aws.amazon.com/ec2/, 2006.
22. D. A. Osvik, A. Shamir, and E. Tromer, "Cache attacks and countermeasures: The case of AES," in Proc. Cryptographers' Track RSA Conf. Topics Cryptol., 2006, pp. 1-20.
23. E. Tromer, D. A. Osvik, and A. Shamir, "Efficient cache attacks on AES, and countermeasures," J. Cryptol., vol. 23, no. 1, pp. 37-71, 2010.
24. K. Okamura, K. Okamura, and Y. Oyama, "Load-based covert channels between xen virtual machines," in Proc. ACM Symp. Appl. Comput., 2010, pp. 173-180.
25. H. Hlavacs, T. Treutner, J.-P. Gelas, L. Lefevre, and A.-C. Orgerie, "Energy consumption side-channel attack at virtual machines in a cloud," in Proc. 9th IEEE Int. Conf. Dependable, Autonomic Secure Comput., 2011, pp. 605-612.
26. J. Wu, L. Ding, Y. Wang, and W. Han, "Identification and evaluation of sharing memory covert timing channel in xen virtual machines," in Proc. 4th IEEE Int. Conf. Cloud Comput., 2011, pp. 283-291.
27. Y. Xu, M. Bailey, F. Jahanian, K. Joshi, M. Hiltunen, and R. Schlichting, "An exploration of L2 cache covert channels in virtualized environments," in Proc. 3rd ACM Workshop Cloud Comput. Security, 2011, pp. 29-39.
28. Y. Zhang, A. Juels, A. Oprea, and M. K. Reiter, "HomeAlone: Co-residency detection in the cloud via side-channel analysis," in Proc. IEEE Symp. Security Privacy, 2011, pp. 313-328.
29. Z. Wang and R. B. Lee, "Covert and side channels due to processor architecture," in Proc. 22nd Annu. Comput. Security Appl. Conf., 2006, pp. 473-482.
30. Z. Wang and R. B. Lee, "New cache designs for thwarting software cache-based side channel attacks," in Proc. 34th Annu. Int. Symp. Comput. Archit., 2007, pp. 494-505.
31. J. Szefer, E. Keller, R. Lee, and J. Rexford, "Eliminating the hypervisor attack surface for a more secure cloud," in Proc. 18th ACM Conf. Comput. Commun. Security, 2011, pp. 401-412.
32. Y. Zhang and M. K. Reiter, "Duppel: Retrofitting commodity operating systems to mitigate cache side channels in the cloud," in Proc. ACMSIGSAC Conf. Comput. Commun. Security, 2013, pp. 827-838.
33. V. Varadarajan, T. Ristenpart, and M. Swift, "Scheduler-based defenses against cross-VM side-channels," in Proc. 23rd USENIX Security Symp., 2014, pp. 687-702.
34. A. Bates, B. Mood, J. Pletcher, H. Pruse, M. Valafar, and K. Butler, "Detecting co-residency with active traffic analysis techniques," in Proc. ACM Workshop Cloud Comput. Security Workshop, 2012, pp. 1-12.
35. S. Yu, X. Gui, J. Lin, X. Zhang, and J. Wang, "Detecting VMs coresidency in cloud: Using cache-based side channel attacks," Elektronika ir Elektrotechnika, vol. 19, no. 5, pp. 73-78, 2013.
36. A. Bates, B. Mood, J. Pletcher, H. Pruse, M. Valafar, and K. Butler, "On detecting co-resident cloud instances using network flow watermarking techniques," Int. J. Inf. Security, vol. 13, no. 2, pp. 171-189, 2014.
37. S. Sundareswaran and A. Squcciarini, "Detecting malicious co-resident virtual machines indulging in load-based attacks," in Proc. 15th Int. Conf. Inf. Commun. Security, 2013, pp. 113-124.
38. S. Yu, X. Gui, and J. Lin, "An approach with two-stage mode to detect cache-based side channel attacks," in Proc. Int. Conf. Inf. Netw., 2013, pp. 186-191.
39. M. Li, Y. Zhang, K. Bai, W. Zhang, M. Yu, and X. He, "Improving cloud survivability through dependency based virtual machine placement," in Proc. Int. Conf. Security Cryptography, 2012, pp. 321-326.
40. Y. Zhang, M. Li, K. Bai, M. Yu, and W. Zang, "Incentive compatible moving target defense against VM-colocation attacks in clouds," in Proc. 27th IFIP TC 11 Inf. Security Privacy Conf., 2012, pp. 388-399.
41. Y. Azar, S. Kamara, I. Menache, M. Raykova, and B. Shepard, "Co-location-resistant clouds," in Proc. 6th ACM Workshop Cloud Comput. Security, 2014, pp. 9-20.
42. Y. Han, T. Alpcan, J. Chan, and C. Leckie, "Security games for virtual machine allocation in cloud computing," in Proc. 4th Int. Conf. Decision Game Theory Security, 2013, pp. 99-118.
43. C. Clark, K. Fraser, S. Hand, J. G. Hansen, E. Jul, C. Limpach, I. Pratt, and A. Warfield, "Live migration of virtual machines," in Proc. 2nd USENIX Symp. Netw. Syst. Des. Implementation, 2005, pp. 273-286.
44. R. T. Marler and J. S. Arora, "Survey of multi-objective optimization methods for engineering," Struct. Multidisciplinary Optimization, vol. 26, no. 6, pp. 369-395, 2004.
45. Y. Han, J. Chan, and C. Leckie, "Analysing virtual machine usage in cloud computing," in Proc. IEEE Int. Workshop Perform. Aspects Cloud Service Virtualization, 2013, pp. 370-377.
46. G. Kramer Synthetic self-similar traffic generation [Online]. Available: Http://glenkramer.com/trfresearch.shtml, 2000.
47. S. A. Baset, L. Wang, and C. Tang, "Towards an understanding of oversubscription in cloud," in Proc. 2nd USENIX Conf. Hot Topics Manage. Internet, Cloud, Enterprise Netw. Serv., 2012, pp. 7-12.
48. Research cloud NeCTAR[Online]. Available: Http://www.nectar. org.au/, 2011.