Analyzing and Mitigating Cross-VM Network Channel Attacks in Cloud Computing Environments

Abstract

Cloud computing has gained popularity due to its service approach, which allows for versatile and on-demand availability of resources for computing. This infrastructure is the foundation for modern business operations. Simultaneously, cloud computing security emerges as a critical concern for enterprises when transferring critical data to geographically dispersed cloud platforms outside of their direct jurisdiction and control. The primary goal of this research is to investigate the impact of virtualization on network safety vulnerabilities in cloud computing and to present the findings. Researchers discovered flaws such as side channel attacks on shared hardware, which allow attackers to extract sensitive data from co-resident virtual machines (VMs). These side channels function as a security entry point, allowing malicious users to spy on data from other VMs. Cloud providers address this by implementing logical resource segregation using internal virtual networks, preventing interference between VM operations on the same host. However, current research lacks empirical exploration of network assaults and countermeasures, primarily focusing on IP, ARP sniffing, and spoofing, thus endangering co-located VM network traffic. While countermeasures do exist, literature overlooks internal device-based network design and comprehensive cloud network isolation. The paper tackles these concerns and showcases the proposed attack by testing it on two prominent IaaS cloud platforms: OpenStack, an open-source IaaS management system, and Oracle Ravello Systems, a publicly accessible IaaS provider, both of which have been set up with specific security requirements. In addition, a counter-measure to the reported attack is proposed.