Virtualization Timing Side-Channel Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Virtualized computing environments face challenges in preventing timing side-channel attacks, where malicious applications exploit shared memory pages to monitor target processes by measuring cache residency and access times, making it difficult to disable page de-duplication entirely without performance and resource implications.
Innovation Solution
The techniques involve obscuring accesses to critical code paths and sensitive data by interleaving instructions from multiple code paths into the same cache lines and using non-standard address translation functions to scramble data, thereby preventing attackers from determining cache residency and access patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If page de-duplication is disabled to prevent timing side-channel attacks, then security against timing attacks is improved, but memory resource consumption increases and system performance degrades
Solution Approach 1:
The patent applies local quality by selectively protecting only specific memory regions (those containing sensitive data or critical code paths) from timing side-channel attacks, rather than disabling page de-duplication globally. This is achieved by marking particular pages with protection attributes and applying specialized access control mechanisms only to those marked pages, while allowing standard page sharing to continue for other memory regions.
Solution Approach 2:
The patent segments the memory system into protected and unprotected regions. By dividing memory pages into those that require timing-side-channel protection and those that do not, the system can maintain security for critical areas while preserving performance and resource efficiency in other areas. This segmentation allows fine-grained control over which memory regions use enhanced protection mechanisms.
2Reliability
If page de-duplication is disabled to prevent timing side-channel attacks, then security against timing attacks is improved, but system performance and startup speed deteriorate
Solution Approach 1:
The patent applies local quality by selectively protecting only specific memory regions (those containing sensitive data or critical code paths) from timing side-channel attacks, rather than disabling page de-duplication globally. This is achieved by marking particular pages with protection attributes and applying specialized access control mechanisms only to those marked pages, while allowing standard page sharing to continue for other memory regions.
Solution Approach 2:
The patent employs preliminary action by establishing page protection attributes and access control mechanisms in advance, before timing side-channel attacks can occur. The system pre-marks sensitive memory regions with protection attributes and prepares specialized access handlers, so that when attacks attempt to probe timing information, the protection mechanisms are already in place to intercept and neutralize the attack without affecting normal operations.
3Reliability
If page de-duplication is completely disabled, then timing side-channel attacks are prevented, but the complexity of system control and configuration increases
Solution Approach 1:
The patent applies local quality by selectively protecting only specific memory regions (those containing sensitive data or critical code paths) from timing side-channel attacks, rather than disabling page de-duplication globally. This is achieved by marking particular pages with protection attributes and applying specialized access control mechanisms only to those marked pages, while allowing standard page sharing to continue for other memory regions.
Solution Approach 2:
The patent employs preliminary action by establishing page protection attributes and access control mechanisms in advance, before timing side-channel attacks can occur. The system pre-marks sensitive memory regions with protection attributes and prepares specialized access handlers, so that when attacks attempt to probe timing information, the protection mechanisms are already in place to intercept and neutralize the attack without affecting normal operations.
Data Source
AI summary
A virtualization service that hosts multiple guests may provide utilities for use in protecting sensitive or secret information from timing side-channel attacks by obscuring accesses to data structures that have been designated as potential targets of such attacks. The service may provide a compiler or analysis tool that identifies data structures within an application that contain, or that are indexed using, sensitive or secret information. The compiler may modify the application code (or an executable representation thereof) to obscure accesses to particular elements in the data structures. For example, the layout or indexing of a sensitive data structure may be scrambled during execution, or elements of multiple data structures may be interleaved within a single, merged data structure. The scrambling may be performed using an unpredictable address translation function (e.g., one that is parameterized during initialization using a random number obtained at runtime), which may be subsequently modified (e.g., periodically).