Fingerprinting large data sets through memory de-duplication technique in virtual machines

Abstract

Because of intellectual property, user privacy, and several other reasons, many scientific and military projects choose to hide the information about the data sets that they are using for analysis and computation. Attackers have designed various mechanisms to compromise the operating system or database management system to steal such information. In this paper, we propose a non-interactive mechanism to identify the data sets in use in a cloud computing environment when the virtual machine (VM) hypervisors adopt the memory de-duplication technique. Specifically, when multiple memory pages with the same contents occupy only one physical page, their reading and writing access delay will demonstrate some special properties. We use the access delay of the memory pages that are unique to some specific data sets to derive out whether or not our VM instance is accessing the same data sets as the target of the attack. The experiment results on a widely used scientific analysis software package ParaView demonstrate the practicability of the attack. We also discuss the mechanisms to defend against such attacks.

Detection of Service Level Agreement (SLA) Violation in Memory Management in Virtual Machines

“…These reading operations will not impact the deduplication procedures. Using the experiment results in [13], [24], [14], we can estimate the time that the algorithm needs to merge the pages. When the estimated delay expires, we will issue the "write" command to the pages of F 2.…”

“…An implementation of the key extraction attack was presented in [23]. The delay caused by separation of deduplicated memory pages in virtual machines has been used to identify guest OS types [13] or derive out memory page contents [24].…”