TWC TTP: Small: RAIN: Analyzing Information Leakage in the Cloud

云计算正以指数级的速度增长，因为它对几乎所有依赖IT系统的公司都有巨大的好处。阻止云进一步采用的最大问题是数据安全和隐私。云服务器设计中的主要安全原则是虚拟隔离，它忽略了通过在同一物理硬件上运行的进程共享的微妙通道的信息泄漏。这个项目的目标是探索形成云的虚拟化机器上的侧通道泄漏。通过利用云测试平台，该项目探索了底层硬件、虚拟化平台和加密软件之间的交互。更好地了解侧通道泄漏有助于设计有效的对策。为了促进有效的过渡到实践，该项目采取了务实的方法，重点关注常用的加密软件库，这些库几乎是任何安全解决方案的核心。为了解决现有加密库中发现的弱点，将发布补丁形式的对策，以确保云服务器的安全。该项目通过发布更新来解决加密软件中的弱点，几乎所有云客户都能立即受益。云采用的持续快速增长进一步放大了这种影响。通过了解虚拟化系统中的漏洞，该项目提高了软件安全社区的意识。通过将成果纳入现有课程，该项目有助于在本科和研究生阶段培训未来的网络安全专家。

Cloud computing is growing at exponential rates due to its great benefits to virtually all companies relying on IT systems. The biggest concern preventing further cloud adoption is data security and privacy. The main security principle in the design of cloud servers has been virtual isolation which ignores information leakage through subtle channels shared by the processes running on the same physical hardware. The goal of this project is to explore side-channel leakage on virtualized machines that form the cloud. By utilizing a cloud testbed, this project explores interactions of the underlying hardware, virtualization platforms, and cryptographic software. A better understanding of side-channel leakages is aiding the design of effective countermeasures. To facilitate effective transition to practice the project is taking a pragmatic approach by focusing on commonly used cryptographic software libraries which lie at the heart of virtually any security solution. To address identified weaknesses in existing crypto libraries, countermeasures in the form of patches will be released, ensuring the security of cloud servers.The project resolves weaknesses in cryptographic software by issuing updates with immediate benefits to virtually all cloud customers. The impact is further amplified by the continuing rapid growth of cloud adoption. By understanding the vulnerabilities in virtualized systems, the project raises awareness in the software security community. By integration of results into existing curricula, the project aids training future cybersecurity experts at the undergraduate and graduate levels.