云环境中跨虚拟机的Cache侧信道攻击技术研究

发布时间：2018-10-26 15:53

【摘要】：在云计算环境中,不同租户的虚拟机可能运行于同一台物理主机之上,即虚拟机同驻.同驻的虚拟机之间共享物理主机的计算资源,并依赖于虚拟机监控器进行系统资源的分配与调度.这种跨域共享虽然提高了资源使用效率,但也给用户的隐私安全造成严重威胁.恶意租户通过探测共享资源的状态信息,建立泄漏模型,便可绕过虚拟化提供的隔离性,窃取其它同驻虚拟机的隐私信息,这种攻击模式通常称为跨虚拟机的侧信道攻击.文中深入分析了跨虚拟机Cache侧信道攻击的机理和实现方式,对跨虚拟机Cache侧信道攻击技术的研究现状与进展进行总结.首先,分析总结了Cache侧信道信息泄露的本质原因;其次,回顾了跨虚拟机Cache侧信道攻击的起源与研究进展,讨论了其与传统Cache侧信道攻击的关系,并提出跨虚拟机访问驱动Cache侧信道攻击的通用模型;然后,分类归纳并重点阐述了虚拟机同驻相关问题以及当前用于跨虚拟机Cache侧信道信息探测的主流方法;最后,分析了目前研究中存在的问题,并展望了未来的研究方向.
[Abstract]:In cloud computing environment, virtual machines of different tenants may run on the same physical host, that is, virtual machines are co-located. The computing resources of the physical host are shared between the virtual machines and the virtual machine monitors are used to allocate and schedule the system resources. Although this cross-domain sharing improves the efficiency of resource use, it also poses a serious threat to the privacy of users. By detecting the state information of shared resources and establishing a leak model, malicious tenants can bypass the isolation provided by virtualization and steal the privacy information of other virtual machines. This attack mode is usually called cross-virtual machine side channel attack. In this paper, the mechanism and implementation of cross-virtual machine Cache side channel attack are deeply analyzed, and the research status and progress of cross-virtual machine Cache side channel attack technology are summarized. Firstly, the essential reasons of Cache channel information leakage are analyzed and summarized. Secondly, the origin and research progress of cross-virtual machine Cache side channel attack are reviewed, the relationship between it and traditional Cache side channel attack is discussed, and a general model of cross-virtual machine access driving Cache side channel attack is proposed. Then, the problems related to virtual machine co-location and the current mainstream methods for channel information detection across virtual machine Cache side are summarized and emphasized. Finally, the problems existing in the current research are analyzed, and the future research directions are prospected.
【作者单位】：西安交通大学电子与信息工程学院;陕西省计算机网络重点实验室(西安交通大学);
【基金】：国家自然科学基金(61472316) 陕西省科技计划项目(2013SZS16,2016ZDJC-05) 中央高校基本科研业务费项目(XKJC2014008)资助~~
【分类号】：TP302

【参考文献】