Side-channel attacks on confidential containers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing side-channel attacks can reveal sensitive information about applications running in confidential containers, exploiting interactions with the host OS kernel, which are not adequately addressed by current security models, posing a threat to the integrity of confidential computing.
Innovation Solution
A method leveraging machine learning (ML) to analyze system calls from within confidential containers, capturing and processing them to extract features using Jaccard and Cosine similarity metrics, enabling adversaries to infer application details by building an ML model from container images, thus identifying system call patterns and performing fingerprinting attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TEEs are used to protect applications while in use, then security and privacy guarantees are improved, but side-channel attacks through the container-host OS kernel interface can still extract sensitive information
Solution Approach 1:
The patent introduces an intermediary analysis layer that captures and analyzes system call traces as intermediaries between the TEE and the outside world. By monitoring system calls (e.g., read, write, open, close) that cross the container-host boundary, the attack extracts sensitive information without directly compromising the TEE's memory protection, thus resolving the contradiction between maintaining TEE security guarantees and preventing side-channel attacks.
Solution Approach 2:
The patent replaces direct memory access attacks with a substitution approach using system call trace analysis. Instead of attempting to break the TEE's memory isolation (mechanical system), the attack substitutes this with observing the behavioral patterns of system calls made by the container, which leak information about the executed application through the kernel interface.
2Loss of information
If system calls are captured and analyzed to identify container images, then information extraction capability is improved, but the complexity of analyzing system call patterns increases
Solution Approach 1:
The patent applies parameter changes by transforming raw system call traces into feature vectors that capture statistical characteristics (e.g., frequency of specific system calls, sequences of operations, temporal patterns). By converting complex system call patterns into quantifiable parameters and feeding them into machine learning models, the attack simplifies the analysis process while maintaining high information extraction capability.
Solution Approach 2:
The patent creates a simplified representation (copy) of the complex system call behavior through feature extraction. Instead of analyzing every detail of system call patterns directly, the attack creates a condensed feature vector that captures the essential characteristics, making the analysis more manageable while preserving the ability to distinguish between different container images.
3Measurement precision
If machine learning models are trained on container images to recognize system call patterns, then attack accuracy is improved, but the computational resources and time required for training increase
Solution Approach 1:
The patent applies preliminary action by pre-training machine learning models on a comprehensive dataset of system call traces from various container images before the actual attack. This offline training phase allows the model to learn and store the characteristic patterns of different applications in advance, so that during the actual attack, the model can quickly and accurately identify container images without requiring real-time training, thus reducing attack time while maintaining high accuracy.
Data Source
Figure 1
Figure 2
AI summary
Method for performing side-channel attacks that permit a user to extract sensitive information of applications running in confidential containers backed by a trusted execution environment, TEE, wherein the confidential containers share the same kernel in an operating system, the method comprising collecting container images from a container image repository by leveraging the container image repository, wherein each container images comprises layers, extracting the layers from each of a container image, storing the extracted layers in a file, capturing invoked application system calls from outside the confidential container and application system calls generated by parent process and children processes within the confidential containers, processing the captured application system calls to extract valuable fields to obtain at least two features vectors, matching system calls to the applications producing said system calls in the confidential container by using the at least two features vectors obtained, performing a feature importance analysis to identify features of the two features vectors to be provided to a machine learning, ML model, providing the ML model with a set of system calls obtained from the identified features, wherein the set of system calls is associated with a victim container, identifying which container images belong to the victim container with the ML model and performing a side-channel attack to the victim container using the identified container images.