Accession Number : AD1030112


Title :   Cloud Fingerprinting: Using Clock Skews To Determine Co Location Of Virtual Machines


Descriptive Note : Technical Report,19 Mar 2015,17 Sep 2016


Corporate Author : Naval Postgraduate School Monterey United States


Personal Author(s) : Wasek,Christopher J


Full Text : https://apps.dtic.mil/dtic/tr/fulltext/u2/1030112.pdf


Report Date : 01 Sep 2016


Pagination or Media Count : 85


Abstract : Cloud computing has quickly revolutionized computing practices of organizations, to include the Department of Defense. However, security concerns over co-location attacks have arisen from the consolidation inherent in virtualization and from physical hardware hosting virtual machines for multiple businesses and organizations. Current cloud security methods, such as Amazons Virtual Private Cloud, have evolved defenses against most of the well-known fingerprinting and mapping methods in order to prevent malicious users from determining virtual machine co-location on the same hardware. Our solution to co-locating virtual machines unhindered was to derive their clock skews, orthe temporal deviation of the system clock over time. Capturing normal TCP traffic to analyze timestamps from a virtual machine in the cloud, our results were inconclusive in demonstrating that co-located virtual machines will have similar clock skews due to large, inconsistent packet delays. Our research demonstrates a potential vulnerability in cloud defenses so that cloud users and providers can take appropriate steps to prevent malicious co-location attacks.


Descriptors :   cloud computing , attack , virtual machines , fingerprint recognition , computer security , network protocols , computers , computing devices , digital data , virtualization software


Distribution Statement : APPROVED FOR PUBLIC RELEASE