CATalyst: Defeating Last-Level Cache Side Channel Attacks in Cloud Computing

Select |




Print


Liu, Fangfei; Ge, Qian; Yarom, Yuval; Mckeen, Frank; Rozas, Carlos; Heiser, Gernot; Lee, Ruby B

Liu, Fangfei; Ge, Qian; Yarom, Yuval; Mckeen, Frank; Rozas, Carlos; Heiser, Gernot; Lee, Ruby B


2016-03-12


Conference Material


IEEE Symposium on High Performance Computer Architecture


Barcelona, Spain


406-418


Cache side channel attacks are a serious threat to multi-tenant public clouds. Past work showed how secret information in one virtual machine (VM) can be extracted by another co-resident VM using such attacks. Recent research demonstrated the feasibility of high-bandwidth, low-noise attacks on the last-level cache (LLC), which is shared by all the cores in the processor package, enabling attacks even when VMs are scheduled on different cores. This paper shows how such LLC side channel attacks can be defeated using a performance optimization feature recently introduced in commodity processors. Since most cloud servers use Intel processors, we show how the Intel Cache Allocation Technology (CAT) can be used in a novel way to provide a system-level protection mechanism to defend from side channel attacks on the shared LLC. CAT is a way-based hardware cache-partitioning mechanism for enforcing quality-of-service with respect to LLC occupancy. However, it cannot be directly used to defeat cache side channel attacks due to the very limited number of partitions it provides. We present CATalyst, a novel pseudo-locking mechanism which uses CAT to partition the LLC into a hybrid hardware-software managed cache. We implement a proof-of-concept system using Xen and Linux running on a server with Intel processors, and show that LLC side channel attacks can be defeated. Furthermore, CATalyst only causes very small performance overhead when used for security, and have negligible impact on the legacy applications.


http://hpca22.site.ac.upc.edu/


nicta:8984


Liu, Fangfei; Ge, Qian; Yarom, Yuval; Mckeen, Frank; Rozas, Carlos; Heiser, Gernot; Lee, Ruby B. CATalyst: Defeating Last-Level Cache Side Channel Attacks in Cloud Computing. In: IEEE Symposium on High Performance Computer Architecture; Barcelona, Spain. 2016-03-12. 406-418.



Loading citation data...

Citation counts
(Requires subscription to view)