Scheduling, isolation, and cache allocation: A side-channel defense

Read Sprabery, Konstantin Evchenko, Abhilash Raj, Rakesh B. Bobba, Sibin Mohan, Roy Campbell

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

Despite the isolation mechanisms that are available to cloud service providers, like virtual machines and containers, the problem of side-channel vulnerabilities due to shared caches and multicore processors remains a threat. We present a hardware-software mechanism that improves the isolation of cloud processes in the presence of shared caches on multicore chips. Our technique can enable cache-side-channel free computing for Linux-based containers and virtual machines by com-bining the Intel CAT architecture that enables cache partitioning with novel scheduling techniques and state cleansing mechanisms. We evaluate our system using a CPU-bound workload and demonstrate cache-side-channel-free computation that is correct by construction. Our system allows Simultaneous Multithreading to remain enabled and does not require application level changes.

Original languageEnglish (US)
Title of host publicationProceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018
EditorsJie Li, Abhishek Chandra, Tian Guo, Ying Cai
PublisherInstitute of Electrical and Electronics Engineers Inc.
Pages34-40
Number of pages7
ISBN (Electronic)9781538650080
DOIs
StatePublished - May 16 2018
Event2018 IEEE International Conference on Cloud Engineering, IC2E 2018 - Orlando, United States
Duration: Apr 17 2018Apr 20 2018

Publication series

NameProceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018

Other

Other2018 IEEE International Conference on Cloud Engineering, IC2E 2018
CountryUnited States
CityOrlando
Period4/17/184/20/18

Fingerprint

Containers
Scheduling
Program processors
Hardware
Virtual machine
Linux

Keywords

  • Cache
  • Defense
  • Scheduler
  • Side channel

ASJC Scopus subject areas

  • Computer Networks and Communications
  • Hardware and Architecture

Cite this

Sprabery, R., Evchenko, K., Raj, A., Bobba, R. B., Mohan, S., & Campbell, R. (2018). Scheduling, isolation, and cache allocation: A side-channel defense. In J. Li, A. Chandra, T. Guo, & Y. Cai (Eds.), Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018 (pp. 34-40). (Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/IC2E.2018.00025

Scheduling, isolation, and cache allocation : A side-channel defense. / Sprabery, Read; Evchenko, Konstantin; Raj, Abhilash; Bobba, Rakesh B.; Mohan, Sibin; Campbell, Roy.

Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018. ed. / Jie Li; Abhishek Chandra; Tian Guo; Ying Cai. Institute of Electrical and Electronics Engineers Inc., 2018. p. 34-40 (Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018).

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Sprabery, R, Evchenko, K, Raj, A, Bobba, RB, Mohan, S & Campbell, R 2018, Scheduling, isolation, and cache allocation: A side-channel defense. in J Li, A Chandra, T Guo & Y Cai (eds), Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018. Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018, Institute of Electrical and Electronics Engineers Inc., pp. 34-40, 2018 IEEE International Conference on Cloud Engineering, IC2E 2018, Orlando, United States, 4/17/18. https://doi.org/10.1109/IC2E.2018.00025
Sprabery R, Evchenko K, Raj A, Bobba RB, Mohan S, Campbell R. Scheduling, isolation, and cache allocation: A side-channel defense. In Li J, Chandra A, Guo T, Cai Y, editors, Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018. Institute of Electrical and Electronics Engineers Inc. 2018. p. 34-40. (Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018). https://doi.org/10.1109/IC2E.2018.00025
Sprabery, Read ; Evchenko, Konstantin ; Raj, Abhilash ; Bobba, Rakesh B. ; Mohan, Sibin ; Campbell, Roy. / Scheduling, isolation, and cache allocation : A side-channel defense. Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018. editor / Jie Li ; Abhishek Chandra ; Tian Guo ; Ying Cai. Institute of Electrical and Electronics Engineers Inc., 2018. pp. 34-40 (Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018).
@inproceedings{3924acb19d124b7f83dfc216ac3692d3,
title = "Scheduling, isolation, and cache allocation: A side-channel defense",
abstract = "Despite the isolation mechanisms that are available to cloud service providers, like virtual machines and containers, the problem of side-channel vulnerabilities due to shared caches and multicore processors remains a threat. We present a hardware-software mechanism that improves the isolation of cloud processes in the presence of shared caches on multicore chips. Our technique can enable cache-side-channel free computing for Linux-based containers and virtual machines by com-bining the Intel CAT architecture that enables cache partitioning with novel scheduling techniques and state cleansing mechanisms. We evaluate our system using a CPU-bound workload and demonstrate cache-side-channel-free computation that is correct by construction. Our system allows Simultaneous Multithreading to remain enabled and does not require application level changes.",
keywords = "Cache, Defense, Scheduler, Side channel",
author = "Read Sprabery and Konstantin Evchenko and Abhilash Raj and Bobba, {Rakesh B.} and Sibin Mohan and Roy Campbell",
year = "2018",
month = "5",
day = "16",
doi = "10.1109/IC2E.2018.00025",
language = "English (US)",
series = "Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018",
publisher = "Institute of Electrical and Electronics Engineers Inc.",
pages = "34--40",
editor = "Jie Li and Abhishek Chandra and Tian Guo and Ying Cai",
booktitle = "Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018",
address = "United States",

}

TY - GEN

T1 - Scheduling, isolation, and cache allocation

T2 - A side-channel defense

AU - Sprabery, Read

AU - Evchenko, Konstantin

AU - Raj, Abhilash

AU - Bobba, Rakesh B.

AU - Mohan, Sibin

AU - Campbell, Roy

PY - 2018/5/16

Y1 - 2018/5/16

N2 - Despite the isolation mechanisms that are available to cloud service providers, like virtual machines and containers, the problem of side-channel vulnerabilities due to shared caches and multicore processors remains a threat. We present a hardware-software mechanism that improves the isolation of cloud processes in the presence of shared caches on multicore chips. Our technique can enable cache-side-channel free computing for Linux-based containers and virtual machines by com-bining the Intel CAT architecture that enables cache partitioning with novel scheduling techniques and state cleansing mechanisms. We evaluate our system using a CPU-bound workload and demonstrate cache-side-channel-free computation that is correct by construction. Our system allows Simultaneous Multithreading to remain enabled and does not require application level changes.

AB - Despite the isolation mechanisms that are available to cloud service providers, like virtual machines and containers, the problem of side-channel vulnerabilities due to shared caches and multicore processors remains a threat. We present a hardware-software mechanism that improves the isolation of cloud processes in the presence of shared caches on multicore chips. Our technique can enable cache-side-channel free computing for Linux-based containers and virtual machines by com-bining the Intel CAT architecture that enables cache partitioning with novel scheduling techniques and state cleansing mechanisms. We evaluate our system using a CPU-bound workload and demonstrate cache-side-channel-free computation that is correct by construction. Our system allows Simultaneous Multithreading to remain enabled and does not require application level changes.

KW - Cache

KW - Defense

KW - Scheduler

KW - Side channel

UR - http://www.scopus.com/inward/record.url?scp=85048346581&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85048346581&partnerID=8YFLogxK

U2 - 10.1109/IC2E.2018.00025

DO - 10.1109/IC2E.2018.00025

M3 - Conference contribution

AN - SCOPUS:85048346581

T3 - Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018

SP - 34

EP - 40

BT - Proceedings - 2018 IEEE International Conference on Cloud Engineering, IC2E 2018

A2 - Li, Jie

A2 - Chandra, Abhishek

A2 - Guo, Tian

A2 - Cai, Ying

PB - Institute of Electrical and Electronics Engineers Inc.

ER -