Infrastructure thrust

Side-channel defense

The basis for the dramatic cost savings enabled by clouds is the sharing of resources that they enable so effectively. This sharing, however, does not come without consequences. Research has shown that sharing hardware resources can cause the unintentional leakage of secret information across tenant boundaries in cloud contexts. These leakages, called side channels, arise due to tenant’s shared use of microarchitectural components on the computers they occupy together. Indeed, such side channels seem inevitable on current hardware platforms, if left unchecked by other defenses.

As a result, in Silver we are leading the development of operator-supported defenses against side channels in cloud contexts, ranging from specialized defenses against side-channels in processor caches [1],[2],[9] to more holistic defenses for wide ranges of side-channel attacks arising from co-residency (e.g., [3],[6],[7]). An example of a cache-specific defense is hypervisor scheduler modifications to ensure that one virtual machine (VM) cannot preempt another with very fine granularity [2], since this is an ingredient in known side-channel attacks leveraging per-core caches. Nomad [6] is an example of a more holistic defense that extends this idea via a provider-assisted service that limits cross-tenant information leakage by carefully coordinating the placement and migration of VMs. By focusing on the root cause of side channels (i.e., co-residency), Nomad is agnostic to the specific side-channel vector used.

Specifically, we have developed three frameworks to illustrate these possibilities. The first, FlowTags [4], allows flexible routing of traffic across arbitrary chains of middleboxes, even as middleboxes alter packet header information that routing traditionally relies on. FlowTags achieves this by inserting tags into end-to-end flows; the logic for computing tags resides at a logically central controller that leverages high-level policy to determine how the tags encode required end-to-end paths and any middlebox-internal actions taken along a route (e.g., content being served out of a cache). The tags can be consumed by middleboxes, enabling them to process the context of processing received by a flow so far (e.g., that it traversed a specific set of middleboxes). This allows end- to-end traffic steering policies to be implemented for specific sets of flows.

The second system, OpenNF [5], is complementary to FlowTags and is designed specifically to support distributed processing across multiple middlebox instances. While virtualization of middleboxes allows easy deployment/tear down of instances in a cloud setting, reallocation of processing across middlebox instances must be coordinated with reallocation of the internal state that middleboxes maintain for the traffic they are processing. OpenNF allows such state reallocation to be synchronized with traffic reallocation decisions and to take place in a safe and consistent fashion. This capability enables novel security applications, e.g., a security application whose capability can be dynamically enhanced to detect sophisticated attacks. That is, an on-site middlebox (e.g., a deep-packet inspection engine) employs simple, local processing to identify suspicious traffic access patterns. When such patterns are observed, deeper analysis of those patterns is seamlessly migrated (along with the state created so far by the local instance’s processing) to a more capable, cloud-resident appliance.

The third system, PGA [8], offers a capability to effectively utilize the other two. In many organizations, policies are independently specified by different actors; e.g., administrators of a department may wish to restrict access to servers they own to users with specific credentials, while an enterprise-wide policy may impose general constraints on who can access what resources. It is important to ensure that such independently specified policies are composed and implemented in a consistent fashion in the underlying infrastructure. PGA providers operators a simple graphical interface to specify complex policies among different sets of end-points, including policies on middlebox traversal and elastic scaling. Each policy can be supported individually using FlowTags and OpenNF.  Crucially, the PGA run-time analyzes multiple such policies for potential conflicts, and if no such conflicts exists, quickly computes a routing configuration that ensures consistent policy enforcement.