TWC TTP: Small: RAIN: Analyzing Information Leakage in the Cloud

TWC TTP：小：RAIN：分析云中的信息泄漏

• 批准号: 1318919
• 负责人: Berk Sunar
• 金额: $ 50万
• 依托单位: Worcester Polytechnic Institute
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2013
• 资助国家: 美国
• 起止时间: 2013-09-01 至 2017-02-28
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1318919&HistoricalAwards=false
• 关键词: TWC; TTP; Small; RAIN; Analyzing

Cloud computing is growing at exponential rates due to its great benefits to virtually all companies relying on IT systems. The biggest concern preventing further cloud adoption is data security and privacy. The main security principle in the design of cloud servers has been virtual isolation which ignores information leakage through subtle channels shared by the processes running on the same physical hardware. The goal of this project is to explore side-channel leakage on virtualized machines that form the cloud. By utilizing a cloud testbed, this project explores interactions of the underlying hardware, virtualization platforms, and cryptographic software. A better understanding of side-channel leakages is aiding the design of effective countermeasures. To facilitate effective transition to practice the project is taking a pragmatic approach by focusing on commonly used cryptographic software libraries which lie at the heart of virtually any security solution. To address identified weaknesses in existing crypto libraries, countermeasures in the form of patches will be released, ensuring the security of cloud servers.The project resolves weaknesses in cryptographic software by issuing updates with immediate benefits to virtually all cloud customers. The impact is further amplified by the continuing rapid growth of cloud adoption. By understanding the vulnerabilities in virtualized systems, the project raises awareness in the software security community. By integration of results into existing curricula, the project aids training future cybersecurity experts at the undergraduate and graduate levels.

云计算正以指数级的速度增长，因为它给几乎所有依赖IT系统的公司带来了巨大的好处。阻碍进一步采用云计算的最大问题是数据安全和隐私。云服务器设计中的主要安全原则是虚拟隔离，它忽略了通过运行在同一物理硬件上的进程共享的微妙通道泄露的信息。这个项目的目标是探索形成云的虚拟化机器上的侧通道泄漏。通过利用云测试平台，该项目探索底层硬件、虚拟化平台和加密软件之间的交互。更好地了解侧通道泄漏有助于设计有效的对策。为了促进向实践的有效过渡，该项目采用了一种实用的方法，专注于几乎所有安全解决方案的核心的常用加密软件库。为了解决现有加密库中已发现的弱点，将发布补丁形式的对策，以确保云服务器的安全性。该项目通过发布更新解决了加密软件的弱点，几乎所有云客户都能立即受益。云应用的持续快速增长进一步扩大了这种影响。通过了解虚拟化系统中的漏洞，该项目提高了软件安全社区的意识。通过将结果整合到现有课程中，该项目有助于在本科和研究生阶段培养未来的网络安全专家。