On the detection of side-channel attacks

Threats posed by side-channel and covert-channel attacks exploiting the CPU cache to compromise the confidentiality of a system raise serious security concerns. This applies especially to systems offering shared hardware or resources to their customers. As eradicating this threat is practically impeded due to performance implications or financial cost of the current mitigation approaches, a detection mechanism might enhance the security of such systems. In the course of this work, we propose an approach towards side-channel attacks detection, considering the specificity of cache-based SCAs and their implementations

The impact of hypervisor scheduling on compromising virtualized environments

A virtualized environment (VE) is expected to provide secure logical isolation across the co-located tenants encapsulated in the virtual machines. In particular the VE should prevent covert-channels exploitation stemming from the usage of shared resources. However, as sophisticated covert- and side-channel attacks exist, the logical isolation in a VE is often considered insufficient to raise concerns about the security in VEs e.g., the Cloud. Technically, the actual feasibility of such attacks strongly depends on the specific context of the execution environment and the resource allocation schemas used in the virtualization solution. Addressing these VE aspects, we detail the effect of scheduling parameters on the noise (affecting the information leakage) in the covert-channel and empirically validate the impact on the feasibility of covert-channel attacks, using a real VE. © 2015 IEEE

InfoLeak:Scheduling-based information leakage

Covert- and side-channel attacks, typically enabled by the usage of shared resources, pose a serious threat to complex systems such as the Cloud. While their exploitation in the real world depends on properties of the execution environment (e.g., scheduling), the explicit consideration of these factors is often neglected. This paper introduces InfoLeak, an information leakage model that establishes the crucial role of the scheduler for exploiting core-private caches as covert channels. We show, formally and empirically, how the availability of these channels and the corresponding attack feasibility are affected by scheduling. Moreover, our model allows security experts to assess the related threat, posed by core-private cache covert channels for a particular system by considering solely the scheduling information. To validate the utility of InfoLeak, we deploy a covert-channel attack and correlate its success ratio to the scheduling of the attacker processes in the target system. We demonstrate the applicability of the InfoLeak model for analyzing the scheduling information for possible information leakage and also provide an example on its usage

Towards a framework for assessing the feasibility of side-channel attacks in virtualized environments

Physically co-located virtual machines should be securely isolated from one another, as well as from the underlying layers in a virtualized environment. In particular the virtualized environment is supposed to guarantee the impossibility of an adversary to attack a virtual machine e.g., by exploiting a side-channel stemming from the usage of shared physical or software resources. However, this is often not the case and the lack of sufficient logical isolation is considered a key concern in virtualized environments. In the academic world this view has been reinforced during the last years by the demonstration of sophisticated side-channel attacks (SCAs). In this paper we argue that the feasibility of executing a SCA strongly depends on the actual context of the execution environment. To reflect on these observations, we propose a feasibility assessment framework for SCAs using cache based systems as an example scenario. As a proof of concept we show that the feasibility of cache-based side-channel attacks can be assessed following the proposed approach

On the feasibility of side-channel attacks in a virtualized environment

The isolation among physically co-located virtual machines is an important prerequisite for ensuring the security in a virtualized environment (VE). The VE should prevent from exploitation of sidechannels stemming from the usage of shared resources, being hardware or software. However, despite the presumed secure logical isolation, a possible information leakage beyond the boundaries of a virtual machine due to side-channel exploits is a key concern in the VE. Such exploits have been demonstrated in the academic world during the last years. This paper takes into consideration the side-channel attacks threat, and points out that the feasibility of a SCA strongly depends on the specific context of the execution environment. The paper proposes a framework for feasibility assessment of SCAs using cache-based exploits as an example scenario. Furthermore, we provide a proof of concept to show how the feasibility of cache-based SCAs can be assessed using the proposed approach. © Springer International Publishing Switzerland 2015

Securing the cloud-assisted smart grid

Rapid elasticity, ubiquitous network access, and highly-reliable services are some of the desirable features of cloud computing that are attractive for building cloud-assisted data-intensive Smart Grid (SG) applications. However, the Distributed Denial-of-Service (DDoS) attacks represent a serious threat to the cloud-assisted SG applications. To mitigate the risk related to the DDoS threat, we propose an SG-relevant Hierarchical Hybrid Cloud-Extension Concept (HHCEC) along with a DDoS attack defense mechanism, termed as Port Hopping Spread Spectrum (PHSS). HHCEC is a cloud-assisted architecture designed to meet scalability and security requirements of the SG applications in the cloud. To prevent transport or application-layer DDoS attacks on HHCEC, PHSS switches the open port of server as a function of time and a secret shared between authorized clients and server, and thus efficiently dropping packets with closed port number. In addition, PHSS spreads the data packets over all the servers versus a single server to provide a robust protection against volume-based DDoS attacks that would affect some of the servers. This packet spreading approach enables PHSS to instantiate replica servers to take over the attacked servers without blocking the whole traffic by utilizing the rapid-elasticity characteristic of the cloud. Moreover, PHSS leverages a shuffling-based containment mechanism in order to quarantine malicious clients in a notably short time. Accordingly, the effect of a DDoS attack based on the compromised secret of the malicious clients is minimized. We evaluate our approach by building a proof-of-concept prototype using Amazon's EC2 and the PlanetLab test-bed. In a DDoS attack scenario, the proposed approach obtains a significant availability enhancement of > 38% that highlight its efficiency in comparison to existing approaches. The results also indicate negligible overhead for the proposed approach compared to the plain system i.e., no additional latency and less than 0.01% throughput degradation

A security architecture for railway signalling

We present the proposed security architecture Deutsche Bahn plans to deploy to protect its trackside safety-critical signalling system against cyber-attacks. We first present the existing reference interlocking system that is built using standard components. Next, we present a taxonomy to help model the attack vectors relevant for the railway environment. Building upon this, we present the proposed “compartmentalized” defence concept for securing the upcoming signalling systems. © Springer International Publishing AG 2017

Challenges and approaches in securing safety-relevant railway signalling

The railway domain is a complex critical infras-tructure (CI) linking communication and control elements, and susceptible to multiple security threats similar to thoseencountered by industrial control systems. However, protectingmodern railway signalling systems is a challenging task giventhe rigorous human safety standards that must be adhered towhile augmenting the systems with security mechanisms. Asrailway CIs are subject to strong regulation and also cannot beadequately protected by physical security given that they aredistributed over large areas, the strong interplay of securityand safety requirements results in both unique problems andsolutions. In this paper, we describe the current state of railwaysignalling, the obstacles to consider when protecting signallingusing state of the art information security, and also outlinecontemporary approaches to address such obstacles. Overall, we propose a shell concept as an approach to decouple safetyand security. © 2017 IEEE

Negotiating and brokering Cloud resources based on Security Level Agreements

Cloud users often motivate their choice of Cloud Service Provider (CSP) based on requirements related with the offered Service Level Agreements (SLA) and costs. Unfortunately, while security has started to play an important role in the decision of using the Cloud, it is quite uncommon for CSPs to specify the security levels associated with their services. This often results in users without the means (i.e., tools and semantics) to negotiate their security requirements with CSPs, in order to choose the one that best suits their needs. However, the recent industrial efforts on specification of Cloud security parameters in SLAs, also known as "Security Level Agreements" or SecLAs is a positive development. In this paper we propose a practical approach to enable the user-centric negotiation and brokering of Cloud resources, based on both the common semantic established by the use of SecLAs and, its quantitative evaluation. The contributed techniques and architecture are the result of jointly applying the security metrology-related techniques being developed by the EU FP7 project ABC4Trust and, the framework for SLA-based negotiation and Cloud resource brokering proposed by the EU FP7 mOSAIC project. The proposed negotiation approach is both feasible and well-suited for Cloud Federations, as demonstrated in this paper with a real-world case study. The presented scenario shows the negotiation of a user's security requirements with respect to a set of CSPs SecLAs, using both the information available in the Cloud Security Alliance's "Security, Trust & Assurance Registry" (CSA STAR) and the WS-Agreement standard

Towards a framework for benchmarking privacy-ABC technologies

Technologies based on attribute-based credentials (Privacy- ABC) enable identity management systems that require minimal disclosure of personal information and provide unlinkability of user’s transactions. However, underlying characteristics of and differences between Privacy-ABC technologies are currently not well understood. In this paper, we present our efforts in defining a framework for benchmarking Privacy-ABC technologies, and identifying an extensive set of benchmarking criteria and factors impacting such benchmarks. In addition, we identify important challenges in the adoption of Privacy-ABC technologies, indicating directions for future research. © IFIP International Federation for Information Processing 2014