Container Co-location Detection via Resource Load Side Channels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
It is challenging for collaborative applications running on different containers to determine if they are co-located on the same host computer without direct access to the host system, as containers have limited access to monitor the host and other containers.
Innovation Solution
A method involving a co-location program that encodes a shared key using error correction code (ECC) and transfers bit strings via side channels to determine co-location by generating high or low loads on resources, allowing containers to identify if they share the same host based on matching key decoding.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If containers use direct host system access to determine co-location, then co-location detection accuracy is improved, but container isolation and security are worsened
Solution Approach 1:
The patent introduces shared resources (CPU, memory, storage) as intermediaries that containers can access indirectly to determine co-location. Instead of direct host access, containers use resource-based side channels (cache sharing, memory access patterns, I/O device sharing) to infer whether they are co-located on the same host, maintaining isolation while enabling detection.
Solution Approach 2:
The patent replaces the mechanical/direct approach of host system access with resource-based indirect communication. Containers use shared resource access patterns (CPU cache, memory bandwidth, storage I/O) as a substitution mechanism to determine co-location without breaking container isolation boundaries.
2Adaptability or versatility
If containers have full host access to monitor resources, then co-location detection capability is improved, but system complexity and security risks are worsened
Solution Approach 1:
The patent applies partial action by allowing containers only the specific level of resource access needed for co-location detection, not full host access. Containers monitor specific resource metrics (CPU usage patterns, memory access, I/O operations) sufficient for determining co-location without obtaining excessive permissions that would increase complexity and security risks.
Solution Approach 2:
Shared resources serve as intermediaries that simplify the detection mechanism. Instead of complex direct host monitoring, containers interact with standardized resource interfaces (CPU, memory, storage) that mediate the detection process, reducing system complexity while maintaining detection capability.
3Object-affected harmful factors
If containers use resource load monitoring to detect co-location, then security and isolation are maintained, but detection precision under low resource activity is worsened
Solution Approach 1:
The patent applies preliminary action by having containers continuously monitor resource access patterns and build baseline profiles of expected resource usage. This preliminary monitoring establishes reference data that enables accurate co-location detection even when current resource activity is low, as containers can compare current patterns against established baselines to infer co-location status.
Solution Approach 2:
The system uses feedback mechanisms where containers continuously monitor resource usage and adjust their detection algorithms based on observed patterns. When resource activity is low, the system incorporates historical feedback data to maintain detection precision, using accumulated information from previous monitoring periods to compensate for current low-signal conditions.
Data Source
AI summary
In an approach to detection of co-location of container services, a method may include monitoring a load on one or more resources accessible by cloud containers located on a first host. The method may further include identifying a bit string from the monitored load of the one or more resources. A high load on the one or more resources for a time period indicates a first bit value, and a low load on the one or more resources for the time period indicates a second alternate bit value. The method may further include receiving a shared key corresponding to a second program in a second cloud container. The method may further include determining the second cloud container is located on the first host based on the shared key matching a key corresponding to the identified bit string.