POSTER: Mitigating Memory Sharing-based Side-channel Attack by Embedding Random Values in Binary for Cloud Environment
Taehun Kim, Youngjoo Shin · 2020
Memory deduplication is a technique that eliminates duplicate physical pages among virtual machines (VMs). Despite the advantage of efficient memory utilization in cloud computing, it leads to memory sharing-based side-channel attacks. Accordingly, most cloud service providers nowadays disable the memory deduplication on their servers to mitigate threats of the attacks, which comes at the cost of the efficiency loss. In this paper, we propose a novel mitigation technique for cloud computing environments against memory sharing-based side-channel attacks. Our technique converts vulnerable applications to secure ones that resist against the attacks. In particular, we utilize binary instrumentation to embed a secret random value inside an executable binary of the application. The random value will prevent memory sharing of security-sensitive applications with other from different security domains. On the other hand, the application-specific approach allows the systemwide memory deduplication, which preserves the efficient memory usage. We present the design and implementation of proposed mitigation as well as its evaluation results.