C2Detector: a covert channel detection framework in cloud computing

Abstract

ABSTRACTCloud computing is becoming increasingly popular because of the dynamic deployment of computing service. Another advantage of cloud is that data confidentiality is protected by the cloud provider with the virtualization technology. However, a covert channel can break the isolation of the virtualization platform and leak confidential information without letting it known by virtual machines. In this paper, the threat model of covert channels is analyzed. The channels are classified into three categories, and only the category that is new to cloud computing is concerned, for example, CPU load‐based, cache‐based, and shared memory‐based covert channels. The covert channel scenario is modeled into an error‐corrected four‐state automaton, and two error‐corrected algorithms are designed. A new detection framework termed C2Detector is presented. C2Detector includes a captor located in the hypervisor and a two‐phase synthesis algorithm implemented as Markov and Bayesian detectors. A prototype of C2Detector is implemented on Xen hypervisor, and its performance of detecting the covert channels is demonstrated. The experiment results show that C2Detector can detect the three types of the covert channels with an acceptable false positive rate by using a pessimistic threshold. Moreover, C2Detector is a plug‐in framework and can be easily extended. It is believed that new covert channels can be detected by C2Detector in the future. Copyright © 2013 John Wiley & Sons, Ltd.