Virtual Machine Co-residency Detection via Cache Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cloud-based systems face challenges in verifying physical isolation of virtual machines, as tenants cannot reliably confirm exclusive use of physical machines, making them vulnerable to side-channel attacks from co-resident virtual machines.
Innovation Solution
Implementing a co-residency detection technique where virtual machines avoid and monitor specific memory resources, such as cache memory, to detect activity from other virtual machines, allowing tenants to determine if they share a physical machine with unrelated tenants.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If cloud service providers use virtualization to abstract hardware for simplicity and flexibility, then system flexibility and ease of operation are improved, but the ability to verify physical isolation and ensure security deteriorates
Solution Approach 1:
The patent applies preliminary action by having the virtual machine perform cache avoidance and monitoring actions before normal operations can proceed. The VM first identifies unused cache portions, avoids them during a monitoring period, and only after confirming no other VM activity occurs in those regions does it proceed with normal operations. This pre-verification step ensures physical isolation before compromising system flexibility.
2Object-affected harmful factors
If tenants demand physical isolation for security, then security protection is improved, but the ability to verify exclusive access and detect co-residency deteriorates
Solution Approach 1:
The patent uses cache memory as an intermediary to detect co-residency. Instead of directly observing other virtual machines or making assumptions about physical isolation, the detection VM uses cache portions as a medium to infer the presence or absence of other VMs. By monitoring cache activity in avoided regions, the system indirectly detects whether other VMs share the same physical hardware, thus solving the verification difficulty while maintaining security.
3Productivity
If virtual machines share physical hardware resources, then resource utilization and productivity are improved, but security vulnerabilities and exposure to attacks increase
Solution Approach 1:
The patent applies dynamics by making the cache usage pattern adaptive and time-dependent. The virtual machine dynamically switches between using and avoiding specific cache portions based on the monitoring phase. During detection periods, the VM avoids certain cache regions to monitor for activity; during normal operation, it can utilize those same regions. This dynamic behavior allows the system to maintain high resource utilization while periodically verifying security conditions.
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach enhances security by enabling tenants to detect and address vulnerabilities, providing assurance of exclusive access and improved protection against side-channel attacks.
Implementation Method 1
at least one virtual machine is configured to avoid usage of a selected portion of a memory resource of the physical machine for a period of time, and to monitor the selected portion of the memory resource for activity during the period of time
Data Source
AI summary
At least one virtual machine implemented on a given physical machine in an information processing system is able to detect the presence of one or more other virtual machines that are also co-resident on that same physical machine. More particularly, at least one virtual machine is configured to avoid usage of a selected portion of a memory resource of the physical machine for a period of time, and to monitor the selected portion of the memory resource for activity during the period of time. Detection of a sufficient level of such activity indicates that the physical machine is also being shared by at least one other virtual machine. The memory resource of the physical machine may comprise, for example, a cache memory, and the selected portion of the memory resource may comprise one or more randomly selected sets of the cache memory.