가상머신 내 mutex 공유 자원을 이용한 은닉 채널 구현
Implementation of Covert Channel Using Mutex Shared Resources in Virtual Machine
1
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
공유 자원 간섭으로 인해 가상머신 간의 격리가 위반되고 은닉 채널 구현이 가능해서 클라우드 컴퓨팅 환경에서가상머신 간의 격리는 중요 보안 요소이다. 본 논문에서는 Hyper-V 하이퍼바이저의 구조를 분석하여 가상머신 간의은닉 채널을 구현한다. Hyper-V는 가상머신 간의 상호 배제를 위해 mutex(mutual exclusion) 기법을 사용한다. Mutex로 인해 가상머신 간의 간섭이 발생하고 은닉 채널 구현이 가능함을 밝힌다. 구조가 복잡한 Hyper-V에 적용가능한 mutex 자원 탐색 방안을 고안하여 은닉 채널을 다수 구현하였다. Mutex 기반 은닉 채널은 하드웨어 의존적이지 않으며, 은닉 채널이 탐지되거나 방어되는 경우 다수의 은닉 채널 중에서 다른 은닉 채널을 이용하면 방어 기법회피가 가능하다.
Abstract
Isolation between virtual machines in a cloud computing environment is an important security factor. The violation ofisolation between virtual machines leads to interferences of shared resources and the implementation of covert channels. Inthis paper, the structure of Hyper-V hypervisor is analyzed to implement covert channels between virtual machines. Hyper-Vuses a mutex technique for mutual exclusion between virtual machines. It indicates that isolation of virtual machines isviolated and covert channels can be implemented due to mutex. We implemented several covert channels by designing amethod for searching mutex resources applicable to Hyper-V with complex architectures. The mutex-based covert channel isnot hardware dependent. If the covert channel is detected or defended, the defensive technique can be avoided by using theother covert channel among several covert channels.
참고문헌 (15)
- K. Okamura, "Load-based covert channels between xen virtual machines", Proceedings of the 2010 ACM Symposium on Applied Computing, pp.173~180 (2010)
- Y. Xu, "An exploration of L2 cache covert channels in virtualized environments", Proceedings of the 3rd ACM Workshop on Cloud Computing Security Workshop, pp.29~40 (2011)
- Z. Wu, "Whispers in the Hyper-space:High-speed Covert Channel Attacks in the Cloud", Proceedings of the 21st USENIX Conference on Security Symposium, pp.9~9 (2012)
- F. Liu, "Last-level cache side-channel attacks are practical", Proceedings of the 2015IEEE Symposium on Security and Privacy, pp.605~622 (2015)
- D. Sullivan, "Microarchitectural Minefields:4K-Aliasing Covert Channel and Multi-Tenant Detection in IaaS Clouds", Proceedings of the Network and Distributed System Security Symposium (2018)
- T. Ristenpar, "Hey, you, get off of my cloud: exploring information leakage in third-party compute clouds", Proceedings of the 16th ACM Conference on Computer and Communications Security, pp.199~212 (2009)
- Z. Yang, "Exploring virtual machine covert channel via i", o performance interference, 2013, 232~239
- M. Salaün, "Practical overview of a Xen covert channel", Journal in Computer Virology, 6(4), pp.317~328 (2010)
- J.Z. Wu, "Identification and evaluation of sharing memory covert timing channel in Xen virtual machines", Proceedings of the IEEE 4th International Conference on Cloud Computing, pp.283~291 (2011)
- Q. Shen, "A covert channel using event channel state on xen hypervisor", Proceedings of the International Conference on Information and Communications Security, pp.125~134 (2013)
- Y. Zhang, "Düppel:retrofitting commodity operating systems to mitigate cache side channels in the cloud", Proceedings of the 2013 ACM Special Interest Group on Security, Audit and Control, pp.827~838 (2013)
- F. Liu, "Catalyst: Defeating last-level cache side channel attacks in cloud computing", Proceedings of the 2016IEEE International Symposium on High Performance Computer Architecture, pp.406~418 (2016)
- P. Barham, "Xen and the art of virtualization", Proceedings of the ACM Special Interest Group in Operating Systems operating systems review, pp.164~177 (2003)
- A. Velte, "Microsoft Virtualization with Hyper-V", pp.448~ (2009), McGraw-Hill, Inc
- "Microsoft Hyper-V Integration Service"[URL]