Advertisement

A Comprehensive Study of Co-residence Threat in Multi-tenant Public PaaS Clouds

  • Weijuan Zhang
  • Xiaoqi Jia
  • Chang Wang
  • Shengzhi Zhang
  • Qingjia Huang
  • Mingsheng Wang
  • Peng Liu
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9977)

Abstract

Public Platform-as-a-Service (PaaS) clouds are always multi-tenant. Applications from different tenants may reside on the same physical machine, which introduces the risk of sharing physical resources with a potentially malicious application. This gives the malicious application the chance to extract secret information of other tenants via side-channels. Though large numbers of researchers focus on the information extraction, there are few studies on the co-residence threat in public clouds, especially PaaS clouds. In this paper, we in detail studied the co-residence threat of public PaaS clouds. Firstly, we investigate the characteristics of different PaaS clouds and implement a memory bus based covert-channel detection method that works for various PaaS cloud platforms. Secondly, we study three popular PaaS clouds Amazon Elastic Beanstalk, IBM Bluemix and OpenShift, to identify the co-residence threat in their placement policies. We evaluate several placement variables (e.g., application type, number of the instances, time launched, data center region, etc.) to study their influence on achieving co-residence. The results show that all the three PaaS clouds are vulnerable to the co-residence threat and the application type plays an important role in achieving co-residence on container-based PaaS clouds. At last, we present an efficient launch strategy to achieve co-residence with the victim on public PaaS clouds.

Keywords

PaaS cloud Co-resident Memory bus Co-residence threat Multi-tenant 

Notes

Acknowledgement

We would like to thank Zeyi Liu and the anonymous reviewers for their insightful and detailed comments. This paper was supported by National Natural Science Foundation of China (NSFC) under Grant No. 61100228 and the project Core Electronic Devices, High-end Generic Chips and Basic Software (No. 2015ZX01029101-001). Peng Liu was supported by NSF CNS-1422594 and NSF SBE-1422215.

References

  1. 1.
    2015 Review Shows $110 billion Cloud Market Growing at 28% Annually (2016). https://www.srgresearch.com/articles/2015-review-shows-110-billion-cloud-market-growing-28-annually. Accessed 3 Mar 2016
  2. 2.
    Platform as a service - a global strategic business report (2015). http://www.strategyr.com/MCP-7070.asp. Accessed 3 Mar 2016
  3. 3.
    Ristenpart, T., Tromer, E., Shacham, H., Savage, S.: Hey, you, get off of my cloud,: exploring information leakage in third-party compute clouds. In: Proceedings of the 16th ACM Conference on Computer and Communications Security, pp. 199–212. ACM (2009)Google Scholar
  4. 4.
    Varadarajan, V., Kooburat, T., Farley, B., Ristenpart, T., Swift, M.M.: Resource-freeing attacks: improve your cloud performance (at your neighbor’s expense). In: Proceedings of the 2012 ACM Conference on Computer and Communications Security, pp. 281–292. ACM (2012)Google Scholar
  5. 5.
    Zhou, F., Goel, M., Desnoyers, P., Sundaram, R.: Scheduler vulnerabilities and attacks in cloud computing. arXiv preprint arXiv:1103.0759 (2011)
  6. 6.
    Xu, Y., Bailey, M., Jahanian, F., Joshi, K., Hiltunen, M., Schlichting, R.: An exploration of L2 cache covert channels in virtualized environments. In: Proceedings of the 3rd ACM Workshop on Cloud Computing Security Workshop, pp. 29–40. ACM (2011)Google Scholar
  7. 7.
    Wu, Z., Xu, Z., Wang, H.: Whispers in the hyper-space: high-speed covert channel attacks in the cloud. In: Presented as Part of the 21st USENIX Security Symposium (USENIX Security 12), pp. 159–173 (2012)Google Scholar
  8. 8.
    Varadarajan, V., Zhang, Y., Ristenpart, T., Swift, M.: A placement vulnerability study in multi-tenant public clouds. In: 24th USENIX Security Symposium (USENIX Security 2015), pp. 913–928 (2015)Google Scholar
  9. 9.
    Xu, Z., Wang, H., Wu, Z.: A measurement study on co-residence threat inside the cloud. In: 24th USENIX Security Symposium (USENIX Security 2015), pp. 929–944 (2015)Google Scholar
  10. 10.
    Zhang, Y., Juels, A., Reiter, M.K., Ristenpart, T.: Cross-tenant side-channel attacks in paas clouds. In: Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security, pp. 990–1003. ACM (2014)Google Scholar
  11. 11.
    Yarom, Y., Falkner, K.: Flush+reload: a high resolution, low noise, L3 cacheside-channel attack. In: 23rd USENIX Security Symposium (USENIX Security 2014), pp. 719–732 (2014)Google Scholar
  12. 12.
    Zhang, Y., Juels, A., Reiter, M.K., Ristenpart, T.: Cross-vm side channels and their use to extract private keys. In: Proceedings of the 2012 ACM Conference on Computer and Communications Security, pp. 305–316. ACM (2012)Google Scholar
  13. 13.
    Amazon. https://aws.amazon.com/cn/. Accessed 23 Apr 2016
  14. 14.
    Bluemix. https://new-console.ng.bluemix.net/. Accessed 23 Apr 2016
  15. 15.
    Openshift. https://developers.openshift.com/. Accessed 23 Apr 2016
  16. 16.
    Docker. https://www.docker.io/. Accessed 23 Apr 2016
  17. 17.
    Guide, P.: Intel\({\textregistered }\) 64 and IA-32 architectures software developers manual (2011)Google Scholar
  18. 18.
    Bates, A., Mood, B., Pletcher, J., Pruse, H., Valafar, M., Butler, K.: Detecting co-residency with active traffic analysis techniques. In: Proceedings of the 2012 ACM Workshop on Cloud Computing Security Workshop, pp. 1–12. ACM (2012)Google Scholar
  19. 19.
    Zhang, Y., Juels, A., Oprea, A., Reiter, M.K.: Homealone: co-residency detection in the cloud via side-channel analysis. In: 2011 IEEE Symposium on Security and Privacy (SP), pp. 313–328. IEEE (2011)Google Scholar
  20. 20.
    Inci, M.S., Gulmezoglu, B., Eisenbarth, T., Sunar, B.: Co-location detection on the cloud (2016)Google Scholar
  21. 21.
    Herzberg, A., Shulman, H., Ullrich, J., Weippl, E.: Cloudoscopy: services discovery and topology mapping. In: Proceedings of the 2013 ACM Workshop on Cloud Computing Security Workshop, pp. 113–122. ACM (2013)Google Scholar
  22. 22.
    Han, Y., Alpcan, T., Chan, J., Leckie, C.: Security games for virtual machine allocation in cloud computing. In: Das, S.K., Nita-Rotaru, C., Kantarcioglu, M. (eds.) GameSec 2013. LNCS, vol. 8252, pp. 99–118. Springer, Heidelberg (2013). doi: 10.1007/978-3-319-02786-9_7 CrossRefGoogle Scholar
  23. 23.
    Han, Y., Chan, J., Alpcan, T., Leckie, C.: Virtual machine allocation policies against co-resident attacks in cloud computing. In: 2014 IEEE International Conference on Communications (ICC), pp. 786–792. IEEE (2014)Google Scholar
  24. 24.
    Azar, Y., Kamara, S., Menache, I., Raykova, M., Shepard, B.: Co-location-resistant clouds. In: Proceedings of the 6th Edition of the ACM Workshop on Cloud Computing Security, pp. 9–20. ACM (2014)Google Scholar

Copyright information

© Springer International Publishing AG 2016

Authors and Affiliations

  • Weijuan Zhang
    • 1
    • 2
    • 3
    • 4
  • Xiaoqi Jia
    • 1
    • 2
    • 3
    • 4
  • Chang Wang
    • 2
    • 3
    • 4
  • Shengzhi Zhang
    • 5
  • Qingjia Huang
    • 2
    • 3
    • 4
  • Mingsheng Wang
    • 1
    • 2
  • Peng Liu
    • 6
  1. 1.State Key Laboratory of Information SecurityInstitute of Information Engineering, CASBeijingChina
  2. 2.University of Chinese Academy of SciencesBeijingChina
  3. 3.Key Laboratory of Network Assessment Technology, IIE, CASBeijingChina
  4. 4.Beijing Key Laboratory of Network Security and Protection TechnologyBeijingChina
  5. 5.School of ComputingFlorida Institute of TechnologyMelbourneUSA
  6. 6.College of Information Sciences and TechnologyThe Pennsylvania State UniversityState CollegeUSA

Personalised recommendations