Reduced Cooling Redundancy: A New Security Vulnerability in a Hot Data Center

Gao, Xing; Xu, Zuhua; Wang, Haining; Li, Li; Wang, Xiaorui

doi:10.14722/ndss.2018.23165

Cited by 28 publications

(11 citation statements)

References 35 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, thermal information can also be used as a proxy estimate for power consumption in data centers. This information can alert potential adversaries to opportune moments to attack the availability of servers, either by exceeding the power capacity [21], or by more generally degrading performance [7]. Although these attacks require privileged thermal sensors, FPGA ROs could also be used for similar purposes, complementing our work in this paper.…”

Section: B Power and Temperature Covert Channelsmentioning

confidence: 90%

C³APSULe: Cross-FPGA Covert-Channel Attacks through Power Supply Unit Leakage

Giechaskiel

Rasmussen

Szefer

2020

2020 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Field-Programmable Gate Arrays (FPGAs) are versatile, reconfigurable integrated circuits that can be used as hardware accelerators to process highly-sensitive data. Leaking this data and associated cryptographic keys, however, can undermine a system's security. To prevent potentially unintentional interactions that could break separation of privilege between different data center tenants, FPGAs in cloud environments are currently dedicated on a per-user basis. Nevertheless, while the FPGAs themselves are not shared among different users, other parts of the data center infrastructure are. This paper specifically shows for the first time that powering FPGAs, CPUs, and GPUs through the same power supply unit (PSU) can be exploited in FPGA-to-FPGA, CPU-to-FPGA, and GPU-to-FPGA covert channels between independent boards. These covert channels can operate remotely, without the need for physical access to, or modifications of, the boards. To demonstrate the attacks, this paper uses a novel combination of "sensing" and "stressing" ring oscillators as receivers on the sink FPGA. Further, ring oscillators are used as transmitters on the source FPGA. The transmitting and receiving circuits are used to determine the presence of the leakage on off-the-shelf Xilinx boards containing Artix 7 and Kintex 7 FPGA chips. Experiments are conducted with PSUs by two vendors, as well as CPUs and GPUs of different generations. Moreover, different sizes and types of ring oscillators are also tested. In addition, this work discusses potential countermeasures to mitigate the impact of the cross-board leakage. The results of this paper highlight the dangers of shared power supply units in local and cloud FPGAs, and therefore a fundamental need to rethink FPGA security for shared infrastructures.

show abstract

Section: B Power and Temperature Covert Channelsmentioning

confidence: 90%

C³APSULe: Cross-FPGA Covert-Channel Attacks through Power Supply Unit Leakage

Giechaskiel

Rasmussen

Szefer

2020

2020 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

show abstract

“…Cloud security has received much attention from both academia [18] and industry. Co-residence detection in the cloud settings is the most closely related research topic to our work.…”

Section: Cloud Security and Side/covert Channel Attacksmentioning

confidence: 99%

A Study on the Security Implications of Information Leakages in Container Clouds

Gao

Steenkamer²,

Gu³

et al. 2021

IEEE Trans. Dependable and Secure Comput.

Self Cite

View full text Add to dashboard Cite

Container technology provides a lightweight operating system level virtual hosting environment. Its emergence profoundly changes the development and deployment paradigms of multi-tier distributed applications. However, due to the incomplete implementation of system resource isolation mechanisms in the Linux kernel, some security concerns still exist for multiple containers sharing an operating system kernel on a multi-tenancy container-based cloud service. In this paper, we first present the information leakage channels we discovered that are accessible within containers. Such channels expose a spectrum of system-wide host information to containers without proper resource partitioning. By exploiting such leaked host information, it becomes much easier for malicious adversaries (acting as tenants in a container cloud) to launch attacks that might impact the reliability of cloud services. We demonstrate that the information leakage channels could be exploited to infer private data, detect and verify co-residence, build covert channels, and launch more advanced cloud-based attacks. We discuss the root causes of the containers' information leakage and propose a two-stage defense approach. As demonstrated in the evaluation, our defense is effective and incurs trivial performance overhead.

show abstract

“…Complacency could lead to the belief that the facility has more time than required to get data center running again, but this can be risky. Gao et al [15] unveiled a new vulnerability of existing data centers with aggressive cooling energy saving policies, conducted thermal experiments, and uncovered effective thermal models at the data center, rack, and server levels. The results demonstrated that thermal attacks can largely increase the temperature of victim servers degrading their performance and reliability, negatively impacting on thermal conditions of neighboring servers causing local hotspots, raising the cooling cost, and even leading to cooling failures.…”

Section: Literature Reviewsmentioning

confidence: 99%

Thermal Performance Evaluation of a Data Center Cooling System under Fault Conditions

Cho

Park²,

Jeong³

2019

Energies

View full text Add to dashboard Cite

If a data center experiences a system outage or fault conditions, it becomes difficult to provide a stable and continuous information technology (IT) service. Therefore, it is critical to design and implement a backup system so that stability can be maintained even in emergency (unforeseen) situations. In this study, an actual 20 MW data center project was analyzed to evaluate the thermal performance of an IT server room during a cooling system outage under six fault conditions. In addition, a method of organizing and systematically managing operational stability and energy efficiency verification was identified for data center construction in accordance with the commissioning process. Up to a chilled water supply temperature of 17 • C and a computer room air handling unit air supply temperature of 24 • C, the temperature of the air flowing into the IT server room fell into the allowable range specified by the American Society of Heating, Refrigerating, and Air-Conditioning Engineers standard (18-27 • C). It was possible to perform allowable operations for approximately 320 s after cooling system outage. Starting at a chilled water supply temperature of 18 • C and an air supply temperature of 25 • C, a rapid temperature increase occurred, which is a serious cause of IT equipment failure. Due to the use of cold aisle containment and designs with relatively high chilled water and air supply temperatures, there is a high possibility that a rapid temperature increase inside an IT server room will occur during a cooling system outage. Thus, the backup system must be activated within 300 s. It is essential to understand the operational characteristics of data centers and design optimal cooling systems to ensure the reliability of high-density data centers. In particular, it is necessary to consider these physical results and to perform an integrated review of the time required for emergency cooling equipment to operate as well as the backup system availability time.As shown in Figure 1, considerable technological infrastructure is required in data centers to meet even the minimum requirements for Tier 1 system availability (96.671% uptime per year), which is the basic level. In specialized colocation data centers for business purposes, enormous system construction costs are required for uninterrupted system operation to ensure Tier 3-4 high availability (95.995-99.982% uptime) [3]. On the other hand, interest in environmental problems such as global warming and the demand for low-energy and high-efficiency buildings is increasing, so the use of excessive facilities in the pursuit of reliability alone must be avoided. Considering these facts, ensuring stable and efficient performance is an important aspect of data center design and implementation. Conventional construction methods are focused on tangible results such as the construction period and financial costs (not quality) necessary to set up the data center infrastructure according to the design plans, which can make it difficult to verify whether non-IT equipment ...

show abstract

Reduced Cooling Redundancy: A New Security Vulnerability in a Hot Data Center

Cited by 28 publications

References 35 publications

C³APSULe: Cross-FPGA Covert-Channel Attacks through Power Supply Unit Leakage

C³APSULe: Cross-FPGA Covert-Channel Attacks through Power Supply Unit Leakage

A Study on the Security Implications of Information Leakages in Container Clouds

Thermal Performance Evaluation of a Data Center Cooling System under Fault Conditions

Contact Info

Product

Resources

About

Reduced Cooling Redundancy: A New Security Vulnerability in a Hot Data Center

Cited by 28 publications

References 35 publications

C3APSULe: Cross-FPGA Covert-Channel Attacks through Power Supply Unit Leakage

C3APSULe: Cross-FPGA Covert-Channel Attacks through Power Supply Unit Leakage

A Study on the Security Implications of Information Leakages in Container Clouds

Thermal Performance Evaluation of a Data Center Cooling System under Fault Conditions

Contact Info

Product

Resources

About

C³APSULe: Cross-FPGA Covert-Channel Attacks through Power Supply Unit Leakage

C³APSULe: Cross-FPGA Covert-Channel Attacks through Power Supply Unit Leakage