Timing Channel in IaaS: How to Identify and Investigate
This addresses security threats for IaaS cloud users by enabling forensic investigation of covert timing channels, though it appears incremental as it builds on known issues with new detection techniques.
The paper tackled the problem of identifying and investigating covert timing channels in IaaS clouds, which traditional methods fail to detect accurately, by proposing a method based on long-term behavior signatures in memory activities, and experiments showed successful detection of four typical channels even with disturbances.
Recently, the IaaS (Infrastructure as a Service) Cloud (e.g., Amazon EC2) has been widely used by many organizations. However, some IaaS security issues create serious threats to its users. A typical issue is the timing channel. This kind of channel can be a cross-VM information channel, as proven by many researchers. Because it is covert and traceless, the traditional identification methods cannot build an accurate analysis model and obtain a compromised result. We investigated the underlying behavior of the timing channel from the perspective of the memory activity records and summarized the signature of the timing channel in the underlying memory activities. An identification method based on long-term behavior signatures was proposed. We proposed a complete set of forensics steps including evidence extraction, identification, record reserve, and evidence reports. We studied four typical timing channels, and the experiments showed that these channels can be detected and investigated, even with disturbances from normal processes.