Defending against co-resident attacks in cloud computing

© 2015 Dr. Yi HanWhile cloud computing has obvious advantages over traditional on-premises computing environments in multiple aspects, including accessibility, availability, cost efficiency and scalability, it also introduces a range of new complications, among which security is a major issue. Previous work has shown that there are security threats in almost every component of cloud computing platforms − from the underlying infrastructure, to the middle layer of the software stack, to the applications that are deployed on top of cloud systems. In this thesis, we focus on a specific threat − the co-resident attack that targets the virtualisation level, the bottom of the software stack. In this type of attack, the attacker has a clear set of target virtual machines (VMs), and they intend to extract private information from these victims, by co-locating their own attack VMs with the target VMs on the same physical server and then building different kinds of side channels. Unlike most previous work that studies the elimination of side channels, we provide a different perspective in this research, by exploring multiple ways to improve VM allocation policies, so that it would be difficult and expensive for attackers to achieve co-location. Specifically, our main contributions include: 1. A set of appropriate security metrics are defined for assessing different VM allocation policies, in terms of their abilities in defending against the co-resident attack. Based on these metrics, an underlying fundamental principle is identified towards designing more secure policies. 2. A new policy named PSSF (Previously Selected Server First) is proposed that takes into consideration all three aspects of security, workload balance and power consumption – it mitigates the threat of co-resident attacks, but also satisfies the constraints in workload balance and low power consumption. In addition, large scale experiments are performed to demonstrate the effectiveness of the policy. 3. A defence mechanism is designed that further improves the effectiveness of the PSSF policy, by including a machine learning approach based on clustering analysis and semi-supervised learning. Our experimental results suggest that once the mechanism is deployed, the overall costs for the attacker will be substantially increased. 4. A game theoretic approach is applied to defend against co-resident attacks for two purposes. First, it demonstrates that in order to increase the unpredictability for the attacker in the VM allocation process, and hence the difficulty to launch attacks, it is better for cloud providers to have a policy pool, where each policy is chosen with a certain probability. Second, a security game model is used to help determine the parameters in the defence mechanism, and guide the defender (cloud provider) to adapt their strategy over time. 5. A comprehensive analysis of VM usage in real-life cloud computing environments is conducted on both the individual user and the system levels. On the individual user level, we identify the potential differences in VM usage, i.e., starting and stopping VMs, between attackers and legal users. This finding is integrated into our defence mechanism for user classification. On the system level, we find that (1) the VM request arrival and departure processes follow a power law distribution and hence exhibit self-similarity; and (2) the number of live VMs in the system can be forecast using an autoregressive integrated moving average (ARIMA) model