C5: Cross-Cores Cache Covert Channel
C5: Cross-Cores Cache Covert Channel
复制标题
DOI：
10.1007/978-3-319-20550-2_3
复制
发表时间：
2015-07
期刊：
影响因子：
--
通讯作者：
Clémentine Maurice;C. Neumann;Olivier Heen;Aurélien Francillon
中科院分区：
文献类型：
--
作者：
Clémentine Maurice;C. Neumann;Olivier Heen;Aurélien Francillon
云计算依赖于管理程序来隔离在共享硬件上运行的虚拟机。由于很难实现完美的隔离，共享硬件会引发威胁。秘密通道被证明违反了隔离，通常允许数据外泄。已经提出了几个依赖于处理器缓存的隐蔽通道。然而，由于寻址的不确定性，这些隐蔽通道要么很慢，要么不切实际。这种不确定性尤其存在于虚拟环境和使用复杂寻址的最新L3缓存中。使用共享内存可以避免寻址不确定性，但共享内存在大多数实际环境中是不可用的。我们构建了C5，这是一个隐蔽通道，在不需要任何共享内存的情况下解决寻址不确定性，使隐蔽通道快速而实用。我们能够在现代硬件上跨同一处理器的任何核心传输消息。隐蔽通道以跨所有内核共享的最后一级缓存为目标。它利用缓存的包含性特征，允许一个核逐出另一个核的私有一级缓存中的行。我们在本地环境和虚拟环境中对该隐蔽通道进行了实验评估。特别是，我们成功地在运行在不同内核上的虚拟机之间建立了一条隐蔽通道。我们测量的本机设置的比特率为1291 Gbps，虚拟设置的比特率为751 Gbps。这比相同设置中以前基于缓存的隐蔽通道高出一个数量级。
Cloud computing relies on hypervisors to isolate virtual machines running on shared hardware. Since perfect isolation is difficult to achieve, sharing hardware induces threats. Covert channels were demonstrated to violate isolation and, typically, allow data exfiltration. Several covert channels have been proposed that rely on the processor’s cache. However, these covert channels are either slow or impractical due to theaddressing uncertainty. This uncertainty exists in particular in virtualized environments and with recent L3 caches which are using complex addressing. Using shared memory would elude addressing uncertainty, but shared memory is not available in most practical setups.We build C5, a covert channel that tackles addressing uncertainty without requiring any shared memory, making the covert channel fast and practical. We are able to transfer messages on modern hardware across any cores of the same processor. The covert channel targets the last level cache that is shared across all cores. It exploits the inclusive feature of caches, allowing a core to evict lines in the private first level cache of another core. We experimentally evaluate the covert channel in native and virtualized environments. In particular, we successfully establish a covert channel between virtual machines running on different cores. We measure a bitrate of 1291 bps for a native setup, and 751 bps for a virtualized setup. This is one order of magnitude above previous cache-based covert channels in the same setup.