StopWatch : Toward “Differentially Private” Timing for Cloud Executions

This paper describes StopWatch , a system that defends against timing-based side-channel attacks that arise from coresidency of victims and attackers in infrastructureas-a-service cloud environments. StopWatch triplicates each cloud-resident guest virtual machine (VM) and places replicas so that the three replicas of a guest VM are coresident with nonoverlapping sets of (replicas of) other VMs. Then, StopWatch uses the timing behaviors of a VM’s replicas collectively to determine the timing of events observed by each one or by an external observer, so that observable timing behaviors could have been observed in the absence of any other individual, coresident VM. In this respect, StopWatch implements a form of “differentially private” timing behavior in a cloud. We detail the design and implementation of StopWatch in Xen, evaluate the factors that influence its performance, and address the problem of placing VM replicas in a cloud under the constraints of StopWatch so as to still enable adequate cloud utilization. Keywords-timing attacks; side channels; replication; clouds