Abstract:

Today's computers run numerous processes of different sensitivity and 
trustworthiness, and often the only boundary between a hostile network 
and sensitive data relies on flimsy confinement assumptions. The 
platform purports to protect processes from each other, but side 
channels arise from lower architectural layers, such as contention for 
shared hardware resources, and create inadvertent cross-talk. For 
example, we have shown how observing contention for the CPU cache allows 
an attacker to steal other users' AES encryption keys in a few milliseconds.

Such cross-talk is especially grievous in the context of third-party 
cloud computing ("infrastructure as a service"), where users acquire 
computational capacity in the form of virtual machines running on a 
service provider's shared hardware pool. The presence of multiple 
mutually-untrusting virtual machines on the same hardware makes them 
potentially vulnerable to the aforementioned side channels. Using Amazon 
EC2 as a case study, we show that an attacker can locate a target in the 
cloud, instantiate his own VM on the same physical machine as the 
target, and exfiltrate information across virtual machine boundaries.

These security vulnerabilities raise the challenge of achieving 
trustworthy computation on leaky platforms. We discuss potential 
solutions, including a new work on mitigating side channels using 
just-in-time dynamic transformation of x86 machine code.

This talk includes joint works with Saman Amarasinghe, Dag Arne Osvik, 
Thomas Ristenpart, Ron Rivest, Stephan Savage, Hovav Shacham, Adi Shamir 
and Qin Zhao.