动态进程隔离
Dynamic Process Isolation
摘要：
为了追求效率和性能，边缘计算提供商消除了租户之间的隔离边界，例如严格的进程隔离，而是让它们在更轻量级的多线程单进程设计中进行计算。边缘计算提供商支持每台机器的大量租户，以减少与客户的物理距离，而无需大量机器。隔离由沙箱机制提供，例如，租户只能运行沙箱V8 JavaScript代码。虽然这与软件漏洞的沙箱一样安全，但微架构攻击可以绕过这些沙箱。在本文中，我们证明了在这样一个受限的环境中进行Spectre攻击是可能的，从而泄露了位于同一地点的租户的秘密。Cloudflare Workers是三大边缘计算解决方案之一，每天在全球数万个网站上每秒处理数百万个HTTP请求。我们演示了一个远程幽灵攻击使用放大技术结合远程定时服务器，这是能够泄漏120位/小时。这激发了我们的主要贡献，动态进程隔离，一个进程隔离机制，只隔离可疑的工人脚本以下的检测机制。在最坏的情况下，只有误报，动态进程隔离简单地降级为进程隔离。我们的概念验证实施增强了真实世界的云基础设施框架Cloudflare Workers，该框架用于大规模生产。假阳性率仅为0.61%，我们证明了我们的解决方案在性能方面大大优于严格的进程隔离。在我们的安全评估中，我们表明动态进程隔离在统计上提供了与严格进程隔离相同的安全保证，完全减轻了多个租户之间的Spectre攻击。
英文摘要：
In the quest for efficiency and performance, edge-computing providers eliminate isolation boundaries between tenants, such as strict process isolation, and instead let them compute in a more lightweight multi-threaded single-process design. Edge-computing providers support a high number of tenants per machine to reduce the physical distance to customers without requiring a large number of machines. Isolation is provided by sandboxing mechanisms, e.g., tenants can only run sandboxed V8 JavaScript code. While this is as secure as a sandbox for software vulnerabilities, microarchitectural attacks can bypass these sandboxes. In this paper, we show that it is possible to mount a Spectre attack on such a restricted environment, leaking secrets from co-located tenants. Cloudflare Workers is one of the top three edge-computing solutions and handles millions of HTTP requests per second worldwide across tens of thousands of web sites every day. We demonstrate a remote Spectre attack using amplification techniques in combination with a remote timing server, which is capable of leaking 120 bit/h. This motivates our main contribution, Dynamic Process Isolation, a process isolation mechanism that only isolates suspicious worker scripts following a detection mechanism. In the worst case of only false positives, Dynamic Process Isolation simply degrades to process isolation. Our proof-of-concept implementation augments a real-world cloud infrastructure framework, Cloudflare Workers, which is used in production at large scale. With a false-positive rate of only 0.61%, we demonstrate that our solution vastly outperforms strict process isolation in terms of performance. In our security evaluation, we show that Dynamic Process Isolation statistically provides the same security guarantees as strict process isolation, fully mitigating Spectre attacks between multiple tenants.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
