HeteroScore: Evaluating and Mitigating Cloud Security Threats Brought by Heterogeneity
HeteroScore: Evaluating and Mitigating Cloud Security Threats Brought by Heterogeneity
复制标题
DOI：
10.14722/ndss.2023.24996
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
Chongzhou Fang;Najmeh Nazari;Behnam Omidi;Han Wang;Aditya Puri;Manish Arora;S. Rafatirad;H. Homayoun;Khaled N. Khasawneh
中科院分区：
文献类型：
--
作者：
Chongzhou Fang;Najmeh Nazari;Behnam Omidi;Han Wang;Aditya Puri;Manish Arora;S. Rafatirad;H. Homayoun;Khaled N. Khasawneh
- 云计算由于其计算能力、数据存储能力、可扩展性、软件/API集成和方便的计费功能，已经成为商业计算基础设施的关键部分。在云计算的早期阶段，大多数云都是同质的，即，大多数机器都是一样的。事实证明，云中的异构性（其中存在各种机器配置）为应用程序提供了更高的性能和功率效率。这是因为异构性使应用程序能够在更合适的硬件/软件环境中运行。近年来，随着各种硬件集成到云系统中以满足日益多样化的用户应用程序的需求，异构云的采用有所增加。与此同时，安全威胁的出现，如微架构攻击，正在成为云用户和提供商面临的一个更加关键的问题。它已经被证明（例如，Repttack and Cloak & Co-locate）认为，微架构攻击的前提条件，即攻击实例和受害实例的协同定位，在异构云中更容易实现。这也意味着攻击的容易性不仅与云的异构性有关，而且随着异构性程度的增加而增加。然而，缺乏数字指标来定义，量化或比较一个云环境与另一个云环境的异构性。在本文中，我们提出了一种新的度量称为异质性得分（HeteroScore），定量评估的异质性的集群。我们证明，HeteroScore是紧密相连的安全性，对协同定位攻击。此外，我们提出了缓解技术，以权衡异构性提供的安全性。我们认为这是第一个评估云异构性并将异构性与基础设施安全性联系起来的定量研究。
—Cloud computing has emerged as a critical part of commercial computing infrastructure due to its computing power, data storage capabilities, scalability, software/API integration, and convenient billing features. At the early stage of cloud computing, the majority of clouds are homogeneous, i.e., most machines are identical. It has been proven that heterogeneity in the cloud, where a variety of machine configurations exist, provides higher performance and power efficiency for applications. This is because heterogeneity enables applications to run in more suitable hardware/software environments. In recent years, the adoption of heterogeneous cloud has increased with the integration of a variety of hardware into cloud systems to serve the requirements of increasingly diversified user applications. At the same time, the emergence of security threats, such as micro-architectural attacks, is becoming a more critical problem for cloud users and providers. It has been demonstrated (e.g., Repttack and Cloak & Co-locate) that the prerequisite of micro-architectural attacks, the co-location of attack and victim instances, is easier to achieve in the heterogeneous cloud. This also means that the ease of attack is not just related to the heterogeneity of the cloud but increases with the degree of heterogeneity. However, there is a lack of numerical metrics to define, quantify or compare the heterogeneity of one cloud environment with another. In this paper, we propose a novel metric called Heterogeneity Score (HeteroScore), which quantitatively evaluates the heterogeneity of a cluster. We demonstrate that HeteroScore is closely connected to security against co-location attacks. Furthermore, we propose mitigation techniques to trade-off heterogeneity offered with security. We believe this is the first quantitative study that evaluates cloud heterogeneity and links heterogeneity to infrastructure security.