Abstract
Covert channels have been an effective means for leaking confidential information across security domains and numerous studies are available on typical covert channels attacks and defenses. Existing covert channel threat restriction solutions are based on the threat estimation criteria of covert channels such as capacity, accuracy, and short messages which are effective in evaluating the information transmission ability of a covert (storage) channel. However, these criteria cannot comprehensively reflect the key factors in the communication process such as shared resources and synchronization and therefore are unable to evaluate covertness and complexity of increasingly upgraded covert storage channels. As a solution, the anti-detection criterion was introduced to eliminate these limitations of cover channels. Though effective, most threat restriction techniques inevitably incur high performance overhead and hence become impractical. In this work, we avoid such overheads and present a restriction algorithm based on the anti-detection criterion to restrict threats that are associated with covert storage channels in virtual machines while maintaining the resource efficiency of the systems. Experimental evaluation shows that our proposed solution is able to counter covert storage channel attacks in an effective manner. Compared with Pump, a well-known traditional restriction algorithm used in practical systems, our solution significantly reduces the system overhead.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
References
Lampson B W. A note on the confinement problem. Commun. ACM, 1973, 16(10): 613-615.
Wang Y, Wu J, Zeng H, Ding L, Liao X. Covert channel research. Journal of Software, 2010, 9(21): 2262-2288. (in Chinese)
Yan M, Shalabi Y, Torrellas J. ReplayConfusion: Detecting cache-based covert channel attacks using record and replay. In Proc. the 49th Annual IEEE/ACM Int. Symp. Microarchitecture, Oct. 2016, Article No. 39.
Archibald R, Ghosal D. Design and analysis of a modelbased covert timing channel for skype traffic. In Proc. IEEE Conf. Communications and Network Security, Sept. 2015, pp.236-244.
Chard K, Caton S, Rana O, Bubendorfer K. Social cloud: Cloud computing in social networks. In Proc. the 3rd IEEE Int. Conf. Cloud Computing, July 2010, pp.99-106.
Riaz A, Qadir J, Younis U, Rasool U R, Ahmad H F, Kiani A K. Intrusion detection systems in cloud computing: A contemporary review of techniques and solutions. Journal of Information Science and Engineering, 2017, 33(3): 611-634.
Wang Z, Hayat M M, Ghani N, Shaban K B. A probabilistic multi-tenant model for virtual machine mapping in cloud systems. In Proc. the 3rd IEEE Int. Conf. Cloud Networking, Oct. 2014, pp.339-343.
Win T Y, Tianfield H, Mair Q, Said T A, Rana O F. Virtual machine introspection. In Proc. the 7th Int. Conf. Security of Information and Networks, September 2014, Article No. 405.
Lin Y, Malik S U R, Bilal K, Yang Q, Wang Y, Khan S U. Designing and modeling of covert channels in operating systems. IEEE Transactions on Computers, 2016, 65(6): 1706-1719.
Kadloor S, Kiyavash N, Venkitasubramaniam P. Mitigating timing side channel in shared schedulers. IEEE/ACM Trans. Netw., 2016, 24(3): 1562-1573.
Evtyushkin D, Ponomarev D, Abu-Ghazaleh N. Understanding and mitigating covert channels through branch predictors. ACM Trans. Archit. Code Optim., 2016, 13(1): Article No. 10.
Zhang R, Su X, Wang J, Wang C, Liu W, Lau R W H. On mitigating the risk of cross-VM covert channels in a public cloud. IEEE Transactions on Parallel and Distributed Systems, 2015, 26(8): 2327-2339.
Ristenpart T, Tromer E, Shacham H, Savage S. Hey, you, get off of my cloud: Exploring information leakage in third-party compute clouds. In Proc. the 16th ACM Conf. Computer and Communications Security, November 2009, pp.199-212.
Wu Z, Xu Z, Wang H. Whispers in the hyper-space: High-bandwidth and reliable covert channel attacks inside the cloud. IEEE/ACM Transactions on Networking, 2015, 23(2): 603-615.
Betz J, Westhoff D. C3-sched — A cache covert channel robust cloud computing scheduler. In Proc. the 9th Int. Conf. Internet Technology and Secured Transactions, Dec. 2014, pp.54-60.
Oren Y, Kemerlis V P, Sethumadhavan S, Keromytis A D. The spy in the sandbox: Practical cache attacks in JavaScript and their implications. In Proc. the 22nd ACM SIGSAC Conf. Computer and Communications Security, Oct. 2015, pp.1406-1418.
Zhang X, Xiao Y, Zhang Y. Return-oriented flush-reload side channels on ARM and their implications for Android devices. In Proc. the 2016 ACM SIGSAC Conf. Computer and Communications Security, Oct. 2016, pp.858-870.
Moskowitz I S, Kang M H. Covert channels-here to stay? In Proc. the 9th IEEE Annual Conf. Computer Assurance, Jun 1994, pp.235-243.
Zander S, Armitage G, Branch P. A survey of covert channels and countermeasures in computer network protocols. IEEE Communications Surveys Tutorials, 2007, 9(3): 44-57.
Wendzel S, Zander S, Fechner B, Herdin C. Pattern-based survey and categorization of network covert channel techniques. ACM Comput. Surv., 2015, 47(3): Article No. 50.
Johnson D, Lutz P, Yuan B. Behavior-based covert channel in cyberspace. In Proc. the 4th International ISKE Conference on Intelligent Systems and Knowledge Engineering, Nov. 2009, pp.311-318.
Wu J, Wang Y, Ding L, Liao X. Improving performance of network covert timing channel through Huffman coding. Mathematical and Computer Modelling, 2012, 55(1): 69-79.
Ksentini A, Abassi O. A comparison of VoIp performance over three routing protocols for IEEE 802.11s-based wireless mesh networks (wlan mesh). In Proc. the 6th ACM Int. Symp. Mobility Management and Wireless Access, Oct. 2008, pp.147-150.
Cabuk S, Brodley C E, Shields C. IP covert timing channels: Design and detection. In Proc. the 11th ACM Conf. Computer and Communications Security, Oct. 2004, pp.178-187.
Maqbool Q, Ayub S, Zulfiqar J, Shafi A. Virtual TCAM for data center switches. In Proc. IEEE Conf. Network Function Virtualization and Software Defined Network, Nov. 2015, pp.61-66.
Tahir R, Khan M T, Gong X, Ahmed A, Ghassami A, Kazmi H, Caesar M, Zaffar F, Kiyavash N. Sneak-peek: High speed covert channels in data center networks. In Proc. the 35th Annual IEEE Int. Conf. Computer Communications, April 2016, Article No. 138.
Wang M, Wu Q, Qin B, Wang Q, Liu J, Guan Z. Lightweight and manageable digital evidence preservation system on bitcoin. Journal of Computer Science and Technology, 2018, 33(3): 568-586.
Zou M H, Ma K, Wu K J, Sha E H M. Scan-based attack on stream ciphers: A case study on eSTREAM finalists. Journal of Computer Science and Technology, 2014, 29(4): 646-655.
Wu J, Ding L, Lin Y, Min-Allah N, Wang Y. XenPump: A new method to mitigate timing channel in cloud computing. In Proc. the 5th IEEE Int. Conf. Cloud Computing, June 2012, pp.678-685.
Goguen J A, Meseguer J. Unwinding and inference control. In Proc. the 1984 IEEE Symp. Security and Privacy, April 1984, pp.75-87.
Denning D E. A lattice model of secure information flow. Commun. ACM, 1976, 19(5): 236-243.
Kemmerer R A. A practical approach to identifying storage and timing channels: Twenty years later. In Proc. the 18th Annual Computer Security Applications Conf., Dec. 2002, pp.109-118.
Wu J, Ding L, Wang Y, Han W. A practical covert channel identification approach in source code based on directed information flow graph. In Proc. the 5th Int. Conf. Secure Software Integration and Reliability Improvement, June 2011, pp.98-107.
Millen J. 20 years of covert channel modeling and analysis. In Proc. the 1999 IEEE Symp. Security and Privacy, May 1999, pp.113-114.
Wu J, Wang Y, Ding L, Zhang Y. Constructing scenario of event-flag covert channel in secure operating system. In Proc. the 2nd Int. Conf. Information and Multimedia Technology, Dec. 2010, pp.371-375.
Lin Y, Ding L, Wu J, Xie Y, Wang Y. Robust and efficient covert channel communications in operating systems: Design, implementation and evaluation. In Proc. the 7th IEEE Int. Conf. Software Security and Reliability, June 2013, pp.45-52.
Zeng H, Wang Y, Zu W, Cai J, Ruan L. New definition of small message criterion and its application in transaction covert channel mitigating. Journal of Software, 2009, 20(4): 985-996. (in Chinese)
Cabuk S, Brodley C E, Shields C. IP covert channel detection. ACM Trans. Inf. Syst. Secur., 2009, 12(4): Article No. 22.
Wang C, Zhang C, Wu B, Tan Y, Wang Y. A novel antidetection criterion for covert storage channel threat estimation. Science China Information Sciences, 2018, 61(4): Article No. 048101.
Tsai C R, Gligor V D. A bandwidth computation model for covert storage channels and its applications. In Proc. the 1988 IEEE Symp. Security and Privacy, Apr. 1988, pp.108-121.
Wu J, Ding L, Wu Y, Min-Allah N, Khan S U, Wang Y. C2Detector: A covert channel detection framework in cloud computing. Sec. and Commun. Netw., 2014, 7(3): 544-557.
Ristad E S, Yianilos P N. Learning string-edit distance. IEEE Transactions on Pattern Analysis and Machine Intelligence, 1998, 20(5): 522-532.
Kang M H, Moskowitz I S. A pump for rapid, reliable, secure communication. In Proc. the 1st ACM Conf. Computer and Communications Security, Nov. 1993, pp.119-129.
Zhai J T, Wang M Q, Liu G J, Dai YW. Detecting jitterbug covert timing channel with sparse embedding. Security and Communication Networks, 2016, 9(11): 1509-1519.
Gianvecchio S, Wang H. Detecting covert timing channels: An entropy-based approach. In Proc. the 2007 ACM Conf. Computer and Communications Security, Oct. 2007, pp.307-316.
Hunger C, Kazdagli M, Rawat A, Dimakis A, Vishwanath S, Tiwari M. Understanding contention-based channels and using them for defense. In Proc. the 21st IEEE Int. Symp. High Performance Computer Architecture, Feb. 2015, pp.639-650.
Zhang R, Su X, Wang J, Wang C, Liu W, Lau R W H. On mitigating the risk of cross-VM covert channels in a public cloud. IEEE Transactions on Parallel and Distributed Systems, 2015, 26(8): 2327-2339.
Caviglione L, Podolski M, Mazurczyk W, Ianigro M. Covert channels in personal cloud storage services: The case of dropbox. IEEE Transactions on Industrial Informatics, 2017, 13(4): 1921-1931.
Gai K, Wu Y, Zhu L, Xu L, Zhang Y. Permissioned blockchain and edge computing empowered privacypreserving smart grid networks. IEEE Internet of Things Journal. doi:https://doi.org/10.1109/JIOT.2019.2904303.
Evtyushkin D, Ponomarev D, Abu-Ghazaleh N. Understanding and mitigating covert channels through branch predictors. ACM Trans. Archit. Code Optim., 2016, 13(1): Article No. 10.
Kim T, Peinado M, Mainar-Ruiz G. STEALTHMEM: System-level protection against cache-based side channel attacks in the cloud. In Proc. the 21st USENIX Security Symp., Aug. 2012, pp.189-204.
Zhang Y, Juels A, Oprea A, Reiter M K. HomeAlone: Coresidency detection in the cloud via side-channel analysis. In Proc. IEEE Symp. Security and Privacy, May 2011, pp.313-328.
Lin Y. Research on the covert channel analysis of general and cross platform technology [Ph.D. Thesis]. Institute of Software, Chinese Academy of Sciences, 2016. (in Chinese)
Xu C J, Ding K H, Cai J Q, Grafarend E W. Methods of determining weight scaling factors for geodetic-geophysical joint inversion. Journal of Geodynamics, 2009, 47(1): 39-46.
Ristad E S, Yianilos P N. Learning string-edit distance. IEEE Transactions on Pattern Analysis and Machine Intelligence, 1998, 20(5): 522-532.
Author information
Authors and Affiliations
Corresponding author
Electronic supplementary material
ESM 1
(PDF 601 kb)
Rights and permissions
About this article
Cite this article
Wang, C., Min-Allah, N., Guan, B. et al. An Efficient Approach for Mitigating Covert Storage Channel Attacks in Virtual Machines by the Anti-Detection Criterion. J. Comput. Sci. Technol. 34, 1351–1365 (2019). https://doi.org/10.1007/s11390-019-1979-8
Received:
Revised:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s11390-019-1979-8