@inproceedings{3924acb19d124b7f83dfc216ac3692d3,
title = "Scheduling, isolation, and cache allocation: A side-channel defense",
abstract = "Despite the isolation mechanisms that are available to cloud service providers, like virtual machines and containers, the problem of side-channel vulnerabilities due to shared caches and multicore processors remains a threat. We present a hardware-software mechanism that improves the isolation of cloud processes in the presence of shared caches on multicore chips. Our technique can enable cache-side-channel free computing for Linux-based containers and virtual machines by com-bining the Intel CAT architecture that enables cache partitioning with novel scheduling techniques and state cleansing mechanisms. We evaluate our system using a CPU-bound workload and demonstrate cache-side-channel-free computation that is correct by construction. Our system allows Simultaneous Multithreading to remain enabled and does not require application level changes.",
keywords = "Cache, Defense, Scheduler, Side channel",
author = "Read Sprabery and Konstantin Evchenko and Abhilash Raj and Bobba, {Rakesh B.} and Sibin Mohan and Roy Campbell",
note = "Publisher Copyright: {\textcopyright} 2018 IEEE.; 2018 IEEE International Conference on Cloud Engineering, IC2E 2018 ; Conference date: 17-04-2018 Through 20-04-2018",
year = "2018",
month = may,
day = "16",
doi = "10.1109/IC2E.2018.00025",
language = "English (US)",
series = "Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018",
publisher = "Institute of Electrical and Electronics Engineers Inc.",
pages = "34--40",
editor = "Jie Li and Abhishek Chandra and Tian Guo and Ying Cai",
booktitle = "Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018",
address = "United States",
}