research-article

Co-Location-Resistant Clouds

Authors:

Mariana Raykova,

Bruce ShepardAuthors Info & Claims

CCSW '14: Proceedings of the 6th edition of the ACM Workshop on Cloud Computing Security

Pages 9 - 20

https://doi.org/10.1145/2664168.2664179

Published: 07 November 2014 Publication History

Abstract

We consider the problem of designing multi-tenant public infrastructure clouds resistant to cross-VM attacks without relying on single-tenancy or on assumptions about the cloud's servers. In a cross-VM attack (which have been demonstrated recently in Amazon EC2) an adversary launches malicious virtual machines (VM) that perform side-channel attacks against co-located VMs in order to recover their contents.

We propose a formal model in which to design and analyze secure VM placement algorithms, which are online vector bin packing algorithms that simultaneously satisfy certain optimization constraints and notions of security. We introduce and formalize several notions of security, establishing formal connections between them. We also introduce a new notion of efficiency for online bin packing algorithms that better captures their cost in the setting of cloud computing.

Finally, we propose a secure placement algorithm that achieves our strong notions of security when used with a new cryptographic mechanism we refer to as a shared deployment scheme.

References

[1]

A. Aviram, S. Hu, B. Ford, and R. Gummadi. Determinating timing channels in compute clouds. In ACM Cloud Computing Security Workshop (CCSW), pages 103--108, 2010.

Digital Library

[2]

Y. Azar, I. Cohen, S. Kamara, and B. Shepherd. Tight bounds for online vector bin packing. In ACM Symposium on Theory of Computing (STOC '13), pages 961--970, 2013.

Digital Library

[3]

R. Canetti. Security and composition of multi-party cryptographic protocols. Journal of Cryptology, 13(1), 2000.

Digital Library

[4]

P. Erdos and A. Renyi. On a classical problem of probability theory. Magyar Tud. Akad. Mat. Kutató Int. Közl., 6:215--220, 1961.

[5]

M. R Garey, R. L. Graham, D. S. Johnson, and A. Yao. Resource constrained scheduling as generalized bin packing. Journal of Combinatorial Theory, Series A, 21(3):257--298, 1976.

[6]

S. Kamara and M. Raykova. Secure outsourced computation in a multi-tenant cloud. Technical report, Workshop on Cryptography and Security in Clouds, 2011.

[7]

T. Kim, M. Peinado, and G. Mainar-Ruiz. System-level protection against cache-based side channel attacks in the cloud. In USENIX Security, 2012.

Digital Library

[8]

S. Lee, R. Panigrahy, V. Prabhakaran, V. Ramasubramanian, K. Talwar, L. Uyeda, and U. Wieder. Validating heuristics for virtual machines consolidation. Technical Report MSR-TR-2011--9, Microsoft Research, 2011.

[9]

P. Li, D. Gao, and M. Reiter. Mitigating access-driven timing channels in clouds using stopwatch. In IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pages 1--12, 2013.

Digital Library

[10]

H. Liu. Amazon data center size. http://huanliu.wordpress.com/2012/03/13/amazon-data-center-size/, 2012.

[11]

R. Martin, J. Demme, and S. Sethumadhavan. Timewarp: rethinking timekeeping and performance monitoring mechanisms to mitigate side-channel attacks. ACM SIGARCH Computer Architecture News, 40(3):118--129, 2012.

Digital Library

[12]

A. Maurer. A bound on the deviation probability for sums of non-negative random variables. Journal of Inequalities in Pure and Applied Mathematics, 4(1):15, 2003.

[13]

R. Panigrahy, K. Talwar, L. Uyeda, and U. Wieder. Heuristics for vector bin packing. Technical report, Microsoft Research, 2011.

[14]

H. Raj, R. Nathuji, A. Singh, and P. England. Resource management for isolation enhanced cloud services. In ACM Cloud Computing Security Workshop (CCSW), pages 77--84, 2009.

Digital Library

[15]

T. Ristenpart, E. Tromer, H. Shacham, and S. Savage. Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds. In ACM conference on Computer and communications security (CCS '09), pages 199--212. ACM, 2009.

Digital Library

[16]

J. Shi, X. Song, H. Chen, and B. Zang. Limiting cache-based side-channel in multi-tenant cloud using dynamic page coloring. In IEEE/IFIP International Conference on Dependable Systems and Networks Workshops (DSN-W), pages 194--199, 2011.

Digital Library

[17]

D. Sleator and R. Tarjan. Amortized efficiency of list update and paging rules. Communications of the ACM, 28(2):202--208, 1985.

Digital Library

[18]

M. Tremante. Amazon web services' growth unrelenting. http://news.netcraft.com/archives/2013/05/20/amazon-web-services-growth-unrelenting.html, 2013.

[19]

V. Varadarajan, T. Ristenpart, and M. Swift. Scheduler-based defenses against cross-vm side-channels. In Usenix Security, 2014.

Digital Library

[20]

B. Vattikonda, S. Das, and H. Shacham. Eliminating fine grained timers in xen. In ACM Cloud Computing Security Workshop (CCSW), pages 41--46, 2011.

Digital Library

[21]

Z. Wang and R. Lee. New cache designs for thwarting software cache-based side channel attacks. ACM SIGARCH Computer Architecture News, 35(2):494--505, 2007.

Digital Library

[22]

Z. Wang and R. Lee. A novel cache architecture with enhanced performance and security. In IEEE/ACM International Symposium on Microarchitecture (MICRO)., pages 83--93, 2008.

Digital Library

[23]

G. Woeginger. There is no asymptotic PTAS for two-dimensional vector packing. Information Processing Letters, 64(6):293--297, 1997.

Digital Library

[24]

Y. Zhang, A. Juels, M. Reiter, and T. Ristenpart. Cross-vm side channels and their use to extract private keys. In ACM Conference on Computer and Communications Security (CCS '12), pages 305--316, 2012.

Digital Library

[25]

Y. Zhang and M. Reiter. Düppel: Retrofitting commodity operating systems to mitigate cache side channels in the cloud. In Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, pages 827--838, 2013.

Digital Library

Cited By

Peng YJiang XWang SXiang YXing L(2024)An Improved Co-Resident Attack Defense Strategy Based on Multi-Level Tenant Classification in Public Cloud PlatformsElectronics10.3390/electronics1316327313:16(3273)Online publication date: 18-Aug-2024
https://doi.org/10.3390/electronics13163273
Zhao ZMorrison AFletcher CTorrellas JTsafrir DMUSUVATHI MGupta RAbu-Ghazaleh N(2024)Everywhere All at Once: Co-Location Attacks on Public Cloud FaaSProceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 110.1145/3617232.3624867(133-149)Online publication date: 27-Apr-2024
https://dl.acm.org/doi/10.1145/3617232.3624867
Xiong JWei MLu ZLiu Y(2024)Warmonger Attack: A Novel Attack Vector in Serverless ComputingIEEE/ACM Transactions on Networking10.1109/TNET.2024.343743232:6(4826-4841)Online publication date: Dec-2024
https://doi.org/10.1109/TNET.2024.3437432
Show More Cited By

Index Terms

Co-Location-Resistant Clouds
1. Security and privacy
2. Social and professional topics
  1. Computing / technology policy
    1. Computer crime

Recommendations

Co-location Resistant Strategy with Full Resources Optimization
CCSW '16: Proceedings of the 2016 ACM on Cloud Computing Security Workshop

In the public clouds, an adversary can co-locate his or her virtual machines (VMs) with others on the same physical servers to start an attack against the integrity, confidentiality or availability. The one important factor to decrease the likelihood of ...
How to hide your VM from the big bad wolf? Co-location resistance vs. resource utilisation in VM placement strategies
ARES '23: Proceedings of the 18th International Conference on Availability, Reliability and Security

VMs in cloud environments are at threat of attacks from VMs co-located on the same server, e. g. through side-channels. Reducing the ability of attackers to achieve co-location with specific VMs can alleviate the risk of targeted attacks. This paper ...
Implementation and performance analysis of various VM placement strategies in CloudSim

Infrastructure as a Service (IaaS) has become one of the most dominant features that cloud computing offers nowadays. IaaS enables datacenter's hardware to get virtualized which allows Cloud providers to create multiple Virtual Machine (VM) instances on ...

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences

CCSW '14: Proceedings of the 6th edition of the ACM Workshop on Cloud Computing Security

November 2014

160 pages

ISBN:9781450332392

DOI:10.1145/2664168

General Chair:
Gail-Joon Ahn
Arizona State University, USA
,
Program Chairs:
Alina Oprea
RSA Laboratories, USA
,
Reihaneh Safavi-Naini
University of Calgary, Canada

Copyright © 2014 ACM.

Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected].

Sponsors

SIGSAC: ACM Special Interest Group on Security, Audit, and Control

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 07 November 2014

Permissions

Request permissions for this article.

Request Permissions

Check for updates

Author Tags

Qualifiers

Research-article

Funding Sources

Conference

CCS'14

Sponsor:

SIGSAC

CCS'14: 2014 ACM SIGSAC Conference on Computer and Communications Security

November 7, 2014

Arizona, Scottsdale, USA

Acceptance Rates

CCSW '14 Paper Acceptance Rate 12 of 36 submissions, 33%;

Overall Acceptance Rate 37 of 108 submissions, 34%

Upcoming Conference

CCS '25

Sponsor:
sigsac

ACM SIGSAC Conference on Computer and Communications Security

October 13 - 17, 2025

Taipei , Taiwan

Contributors

Other Metrics

View Article Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

51
Total Citations
View Citations
409
Total Downloads

Downloads (Last 12 months)26
Downloads (Last 6 weeks)4

Reflects downloads up to 28 Feb 2025

Other Metrics

View Author Metrics

Citations

Cited By

Peng YJiang XWang SXiang YXing L(2024)An Improved Co-Resident Attack Defense Strategy Based on Multi-Level Tenant Classification in Public Cloud PlatformsElectronics10.3390/electronics1316327313:16(3273)Online publication date: 18-Aug-2024
https://doi.org/10.3390/electronics13163273
Zhao ZMorrison AFletcher CTorrellas JTsafrir DMUSUVATHI MGupta RAbu-Ghazaleh N(2024)Everywhere All at Once: Co-Location Attacks on Public Cloud FaaSProceedings of the 29th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 110.1145/3617232.3624867(133-149)Online publication date: 27-Apr-2024
https://dl.acm.org/doi/10.1145/3617232.3624867
Xiong JWei MLu ZLiu Y(2024)Warmonger Attack: A Novel Attack Vector in Serverless ComputingIEEE/ACM Transactions on Networking10.1109/TNET.2024.343743232:6(4826-4841)Online publication date: Dec-2024
https://doi.org/10.1109/TNET.2024.3437432
Thabet MBerrima MHnich B(2024)Assessing the Robustness of ACLRPS-RC Algorithm on Microsoft Azure DatasetProcedia Computer Science10.1016/j.procs.2024.09.239246(169-178)Online publication date: 2024
https://doi.org/10.1016/j.procs.2024.09.239
Le MAhmed SWilliams DJamjoom H(2023)Securing Container-based Clouds with Syscall-aware SchedulingProceedings of the 2023 ACM Asia Conference on Computer and Communications Security10.1145/3579856.3582835(812-826)Online publication date: 10-Jul-2023
https://dl.acm.org/doi/10.1145/3579856.3582835
Zhao GLiu JZhai YXu HHe H(2023)Alleviating the Impact of Abnormal Events Through Multi-Constrained VM PlacementIEEE Transactions on Parallel and Distributed Systems10.1109/TPDS.2023.324868134:5(1508-1523)Online publication date: May-2023
https://doi.org/10.1109/TPDS.2023.3248681
Thabet MBerrima MHnich B(2023)A secure optimal placement strategy based on Monte Carlo simulation and hypothesis testingFuture Generation Computer Systems10.1016/j.future.2022.07.025138:C(89-103)Online publication date: 1-Jan-2023
https://dl.acm.org/doi/10.1016/j.future.2022.07.025
Aldawood MJhumka AFahmy S(2023)Toward Secure VMs Allocation: Analysis of VMs Allocation Behaviours in the Cloud Computing EnvironmentsCloud Computing and Services Science10.1007/978-3-031-21637-4_2(25-46)Online publication date: 1-Jan-2023
https://doi.org/10.1007/978-3-031-21637-4_2
Levitin GXing LXiang Y(2022) Co-Residence Data Theft Attacks on N -Version Programming-Based Cloud Services With Task Cancelation IEEE Transactions on Systems, Man, and Cybernetics: Systems10.1109/TSMC.2020.300293052:1(324-333)Online publication date: Jan-2022
https://doi.org/10.1109/TSMC.2020.3002930
Levitin GXing LXiang Y(2022) Reliability versus Vulnerability of N -Version Programming Cloud Service Component With Dynamic Decision Time Under Co-Resident Attacks IEEE Transactions on Services Computing10.1109/TSC.2020.301942015:4(1774-1784)Online publication date: 1-Jul-2022
https://doi.org/10.1109/TSC.2020.3019420
Show More Cited By

View Options

Login options

Check if you have access through your login credentials or your institution to get full access on this article.

Full Access

Get this Publication

View options

PDF

View or Download as a PDF file.

eReader

View online with eReader.

Figures

Tables

Media

View Table of Conten