A Novel Scheduling Framework Leveraging Hardware Cache Partitioning for Cache-Side-Channel Elimination in Clouds

Abstract

While there exist many isolation mechanisms that are available to cloud service providers, including virtual machines, containers, etc. , the problem of side-channel increases in importance as a remaining security vulnerability – particularly in the presence of shared caches and multicore processors. In this paper we present a hardware-software mechanism that improves the isolation of cloud processes in the presence of shared caches on multicore chips. Combining the Intel CAT architecture that enables cache partitioning on the �y with novel scheduling techniques and state cleansing mechanisms, we enable cache-side-channel free computing for Linux-based containers and virtual machines, in particular, those managed by KVM. We do a preliminary evaluation of our system using a CPU bound workload. Our system allows Simultaneous Multithreading (SMT) to remain enabled and does not require application level changes.

13 Figures and Tables

Cite this paper

@article{Sprabery2017ANS, title={A Novel Scheduling Framework Leveraging Hardware Cache Partitioning for Cache-Side-Channel Elimination in Clouds}, author={Read Sprabery and Konstantin Evchenko and Abhilash Raj and Rakesh Bobba and Sibin Mohan and Roy H. Campbell}, journal={CoRR}, year={2017}, volume={abs/1708.09538} }