Detection of side channel attacks between virtual machines
AssigneeEmpire Technology Development LLC
InventorKevin S. Fine
Life of this patent
Estimating the term…
Abstract
Technologies are directed to a detector to identify a side channel attack between virtual machines. According to some examples, an inter-processor interrupt (IPI) rate of a first virtual machine (VM), a time stamp counter (TSC) rate of a second VM, and a cache miss ratio (CMR) of a third VM may be monitored. A side channel attack may then be detected based on the IPI rate, the TSC rate, and the CMR.
Claims20
A method to detect a side channel attack between virtual machines, the method comprising:
- monitoring an inter-processor interrupt (IPI) rate of a first virtual machine (VM);
- monitoring a time stamp counter (TSC) rate of a second VM;
- monitoring a cache miss ratio (CMR) of a third VM;
- detecting the side channel attack based on the IPI rate, the TSC rate, and the CMR;
- and
- labeling the third VM as a victim candidate in response to a detection that the CMR exceeds a predetermined CMR threshold.
A computing device to detect a side channel attack between virtual machines, the computing device comprising:
- a memory configured to store instructions;
- a controller coupled to the memory, wherein the controller executes a side channel attack detection module, the side channel attack detection module configured to:
- monitor an inter-processor interrupt (IPI) rate of a first virtual machine (VM);
- monitor a time stamp counter (TSC) rate of a second VM;
- detect the IPI rate to exceed a predetermined IPI rate threshold;
- label the first VM as at least one from a set of:
- an accomplice candidate and a bystander candidate;
- monitor a cache miss ratio (CMR) of a third VM;
- detect the side channel attack based on the IPI rate, the TSC rate, and the CMR;
- detect the CMR to exceed a predetermined CMR threshold;
- and
- label the third VM as a victim candidate.
A non-transitory computer-readable storage medium with instructions stored thereon to detect a side channel attack between virtual machines, the instructions in response to execution causing a method to be performed, wherein the method comprises:
- monitoring an inter-processor interrupt (IPI) rate of a first virtual machine (VM);
- detecting the IPI rate to exceed a predetermined IPI rate threshold;
- labeling the first VM as at least one from a set of:
- an accomplice candidate and a bystander candidate;
- monitoring a time stamp counter (TSC) rate of a second VM;
- detecting the TSC rate to exceed a predetermined TSC rate threshold;
- labeling the second VM as an attacker candidate;
- monitoring a cache miss ratio (CMR) of a third VM;
- detecting the side channel attack based on the IPI rate, the TSC rate, and the CMR;
- and
- labeling the third VM as a victim candidate in response to a detection that the CMR exceeds a predetermined CMR threshold.
Dependencies are inferred from the claim text.