STEALTHMEM: system-level protection against cache-based side channel attacks in the cloud

TLDR

Cloud services are rapidly adopted for cost efficiency, availability, and scaling, but shared hardware enables cache‑based side‑channel attacks that can recover full encryption keys, raising security concerns for multi‑tenant environments. The authors introduce STEALTHMEM, a system‑level protection mechanism that isolates cache lines per virtual machine to defend against cache‑based side‑channel attacks in the cloud. STEALTHMEM locks a set of cache lines per core, multiplexes them among VMs, exploits set‑associative cache properties, and operates on commodity hardware with minimal software changes. STEALTHMEM allows VMs to conceal memory‑access patterns from others while imposing only 5.9 % overhead on SPEC 2006 and 2–5 % on AES, DES, and Blowfish, with just 3–34 lines of code modifications.

Abstract

Cloud services are rapidly gaining adoption due to the promises of cost efficiency, availability, and on-demand scaling. To achieve these promises, cloud providers share physical resources to support multi-tenancy of cloud platforms. However, the possibility of sharing the same hardware with potential attackers makes users reluctant to offload sensitive data into the cloud. Worse yet, researchers have demonstrated side channel attacks via shared memory caches to break full encryption keys of AES, DES, and RSA. We present STEALTHMEM, a system-level protection mechanism against cache-based side channel attacks in the cloud. STEALTHMEM manages a set of locked cache lines per core, which are never evicted from the cache, and efficiently multiplexes them so that each VM can load its own sensitive data into the locked cache lines. Thus, any VM can hide memory access patterns on confidential data from other VMs. Unlike existing state-of-the-art mitigation methods, STEALTHMEM works with existing commodity hardware and does not require profound changes to application software. We also present a novel idea and prototype for isolating cache lines while fully utilizing memory by exploiting architectural properties of set-associative caches. STEALTHMEM imposes 5.9% of performance overhead on the SPEC 2006 CPU benchmark, and between 2% and 5% overhead on secured AES, DES and Blowfish, requiring only between 3 and 34 lines of code changes from the original implementations.