Please use this identifier to cite or link to this item:
Scopus Web of Science® Altmetric
Type: Conference paper
Title: CATalyst: Defeating last-level cache side channel attacks in cloud computing
Author: Liu, F.
Ge, Q.
Yarom, Y.
McKeen, F.
Rozas, C.
Heiser, G.
Lee, R.
Citation: Proceedings - International Symposium on High-Performance Computer Architecture, 2016, vol.2016-April, pp.406-418
Publisher: IEEE
Issue Date: 2016
Series/Report no.: International Symposium on High-Performance Computer Architecture-Proceedings
ISBN: 9781467392112
ISSN: 1530-0897
Conference Name: 22nd IEEE International Symposium on High-Performance Computer Architecture (HPCA) (12 Mar 2016 - 16 Mar 2016 : Barcelona, Spain)
Statement of
Fangfei Liu, Qian Ge, Yuval Yarom, Frank Mckeen, Carlos Rozas, Gernot Heiser, Ruby B. Lee
Abstract: Cache side channel attacks are serious threats to multi-tenant public cloud platforms. Past work showed how secret information in one virtual machine (VM) can be extracted by another co-resident VM using such attacks. Recent research demonstrated the feasibility of high-bandwidth, lownoise side channel attacks on the last-level cache (LLC), which is shared by all the cores in the processor package, enabling attacks even when VMs are scheduled on different cores. This paper shows how such LLC side channel attacks can be defeated using a performance optimization feature recently introduced in commodity processors. Since most cloud servers use Intel processors, we show how the Intel Cache Allocation Technology (CAT) can be used to provide a system-level protection mechanism to defend from side channel attacks on the shared LLC. CAT is a waybased hardware cache-partitioning mechanism for enforcing quality-of-service with respect to LLC occupancy. However, it cannot be directly used to defeat cache side channel attacks due to the very limited number of partitions it provides. We present CATalyst, a pseudo-locking mechanism which uses CAT to partition the LLC into a hybrid hardwaresoftware managed cache. We implement a proof-of-concept system using Xen and Linux running on a server with Intel processors, and show that LLC side channel attacks can be defeated. Furthermore, CATalyst only causes very small performance overhead when used for security, and has negligible impact on legacy applications.
Rights: © 2016 IEEE
DOI: 10.1109/HPCA.2016.7446082
Appears in Collections:Aurora harvest 8
Computer Science publications

Files in This Item:
File Description SizeFormat 
  Restricted Access
Restricted Access272.21 kBAdobe PDFView/Open

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.