Timing Channel in IaaS: How to Identify and Investigate

TL;DR

This paper investigates the behavior of timing channels in IaaS cloud environments, proposing a signature-based detection method and forensic steps to identify and analyze covert cross-VM communication channels.

Contribution

It introduces a novel long-term behavior signature approach for detecting timing channels and provides a comprehensive forensic framework for investigation.

Findings

Timing channels can be detected despite normal process disturbances.

The proposed method accurately identifies four typical timing channels.

Forensic steps enable effective evidence collection and reporting.

Abstract

Recently, the IaaS (Infrastructure as a Service) Cloud (e.g., Amazon EC2) has been widely used by many organizations. However, some IaaS security issues create serious threats to its users. A typical issue is the timing channel. This kind of channel can be a cross-VM information channel, as proven by many researchers. Because it is covert and traceless, the traditional identification methods cannot build an accurate analysis model and obtain a compromised result. We investigated the underlying behavior of the timing channel from the perspective of the memory activity records and summarized the signature of the timing channel in the underlying memory activities. An identification method based on long-term behavior signatures was proposed. We proposed a complete set of forensics steps including evidence extraction, identification, record reserve, and evidence reports. We studied four typical timing channels, and the experiments showed that these channels can be detected and investigated, even with disturbances from normal processes.