TWC TTP: Small: RAIN: Analyzing Information Leakage in the Cloud

云计算正在以指数级的速度增长，因为它给几乎所有依赖IT系统的公司带来了巨大的好处。阻止进一步采用云的最大担忧是数据安全和隐私。云服务器设计的主要安全原则是虚拟隔离，它忽略了通过运行在相同物理硬件上的进程共享的微妙通道进行的信息泄漏。该项目的目标是探索形成云的虚拟计算机上的侧通道泄漏。通过利用云试验台，该项目探索了底层硬件、虚拟化平台和加密软件之间的交互。更好地了解侧沟泄漏有助于设计有效的对策。为了促进向实践的有效过渡，该项目采取了一种务实的做法，将重点放在通常使用的加密软件库上，这些软件库是几乎所有安全解决方案的核心。为了解决现有加密库中发现的漏洞，将发布补丁形式的对策，确保云服务器的安全。该项目通过向几乎所有云客户发布即时受益的更新来解决密码软件中的漏洞。云采用的持续快速增长进一步放大了这种影响。通过了解虚拟系统中的漏洞，该项目提高了软件安全社区的意识。通过将成果整合到现有课程中，该项目帮助培训未来的本科生和研究生网络安全专家。

Cloud computing is growing at exponential rates due to its great benefits to virtually all companies relying on IT systems. The biggest concern preventing further cloud adoption is data security and privacy. The main security principle in the design of cloud servers has been virtual isolation which ignores information leakage through subtle channels shared by the processes running on the same physical hardware. The goal of this project is to explore side-channel leakage on virtualized machines that form the cloud. By utilizing a cloud testbed, this project explores interactions of the underlying hardware, virtualization platforms, and cryptographic software. A better understanding of side-channel leakages is aiding the design of effective countermeasures. To facilitate effective transition to practice the project is taking a pragmatic approach by focusing on commonly used cryptographic software libraries which lie at the heart of virtually any security solution. To address identified weaknesses in existing crypto libraries, countermeasures in the form of patches will be released, ensuring the security of cloud servers.The project resolves weaknesses in cryptographic software by issuing updates with immediate benefits to virtually all cloud customers. The impact is further amplified by the continuing rapid growth of cloud adoption. By understanding the vulnerabilities in virtualized systems, the project raises awareness in the software security community. By integration of results into existing curricula, the project aids training future cybersecurity experts at the undergraduate and graduate levels.