A Comprehensive Study of Co-residence Threat in Multi-tenant Public PaaS Clouds

作者：Zhang, Weijuan; Jia, Xiaoqi; Wang, Chang; Zhang, Shengzhi; Huang, Qingjia^*; Wang, Mingsheng; Liu, Peng

来源：18th International Conference on Information and Communications Security (ICICS), 2016-11-29 To 2016-12-02.

DOI：10.1007/978-3-319-50011-9_28

• PaaS cloud
• Co-resident
• Memory bus
• Co-residence threat
• Multi-tenant

Public Platform-as-a-Service (PaaS) clouds are always multitenant. Applications from different tenants may reside on the same physical machine, which introduces the risk of sharing physical resources with a potentially malicious application. This gives the malicious application the chance to extract secret information of other tenants via side-channels. Though large numbers of researchers focus on the information extraction, there are few studies on the co-residence threat in public clouds, especially PaaS clouds. In this paper, we in detail studied the co-residence threat of public PaaS clouds. Firstly, we investigate the characteristics of different PaaS clouds and implement a memory bus based covert-channel detection method that works for various PaaS cloud platforms. Secondly, we study three popular PaaS clouds Amazon Elastic Beanstalk, IBM Bluemix and OpenShift, to identify the co-residence threat in their placement policies. We evaluate several placement variables (e.g., application type, number of the instances, time launched, data center region, etc.) to study their influence on achieving co-residence. The results show that all the three PaaS clouds are vulnerable to the co-residence threat and the application type plays an important role in achieving co-residence on container-based PaaS clouds. At last, we present an efficient launch strategy to achieve co-residence with the victim on public PaaS clouds.

• 出版日期2016
• 单位中国科学院; 中国科学院信息工程研究所; 信息安全国家重点实验室; 中国科学院大学