An Effective and Scalable VM Migration Strategy to Mitigate Cross-VM Side-Channel Attacks in Cloud

Co-residency of virtual machines(VMs) of different tenants on the same physical platform would possibly lead to cross-VM side-channel attacks in the cloud. While most of current countermeasures fail for real or immediate deployment due to their requirement for modification of virtualization structure, we adopt dynamic migration, an inherent mechanism of the cloud platform, as a general defense against this kind of threats. To this end, we first set up a unified practical information leakage model which shows the factors affecting side channels and describes the way they influence the damage due to side-channel attacks. Since migration is adopted to limit the time duration of co-residency, we envision this defense as an optimization problem by setting up an Integer Linear Programming(ILP) to calculate optimal migration strategy, which is intractable due to high computational complexity. Therefore, we approximate the ILP with a baseline genetic algorithm, which is further improved for its optimality and scalability. Experimental results show that our migration-based defense can not only provide excellent security guarantees and affordable performance cost in both theoretical simulation and practical cloud environment, but also achieve better optimality and scalability than previous countermeasures.

Intrusion Detection System for PS-Poll DoS Attack in 802.11 Networks Using Real Time Discrete Event System

Wi-Fi devices have limited battery life because of which conserving battery life is imperative. The 802.11 Wi-Fi standard provides power management feature that allows stations(STAs) to enter into sleep state to preserve energy without any frame losses. After the STA wakes up, it sends a null data or PS-Poll frame to retrieve frame(s) buffered by the access point(AP), if any during its sleep period. An attacker can launch a power save denial of service(PS-DoS) attack on the sleeping STA(s) by transmitting a spoofed null data or PS-Poll frame(s) to retrieve the buffered frame(s) of the sleeping STA(s) from the AP causing frame losses for the targeted STA(s). Current approaches to prevent or detect the PS-DoS attack require encryption,change in protocol or installation of proprietary hardware. These solutions suffer from expensive setup, maintenance, scalability and deployment issues. The PS-DoS attack does not differ in semantics or statistics under normal and attack circumstances.So signature and anomaly based intrusion detection system(IDS) are unfit to detect the PS-DoS attack. In this paper we propose a timed IDS based on real time discrete event system(RTDES) for detecting PS-DoS attack. The proposed DES based IDS overcomes the drawbacks of existing systems and detects the PS-DoS attack with high accuracy and detection rate. The correctness of the RTDES based IDS is proved by experimenting all possible attack scenarios.

Further Analysis of Block Ciphers against Timing Attacks

Timing attacks break a cryptosystem by time measurement to recover keys. Most available countermeasures protect block ciphers based on the safety of modules. This paper gives a complete definition of timing attacks and studies the vulnerability of operations and modules on timing attacks. We present a method to transfer the security of the algorithm to that of secure operations by reduction. As a result, we hopefully tend to reconcile the provable security notions and modem cryptography with real-world implementations of block ciphers.

Hybrid-triggered consensus for multi-agent systems with time-delays,uncertain switching topologies, and stochastic cyber-attacks

We propose a new approach to discuss the consensus problem of multi-agent systems with time-varying delayed control inputs, switching topologies, and stochastic cyber-attacks under hybrid-triggered mechanism.A Bernoulli variable is used to describe the hybrid-triggered scheme, which is introduced to alleviate the burden of the network.The mathematical model of the closed-loop control system is established by taking the influences of time-varying delayed control inputs,switching topologies, and stochastic cyber-attacks into account under the hybrid-triggered scheme.A theorem as the main result is given to make the system consistent based on the theory of Lyapunov stability and linear matrix inequality.Markov jumps with uncertain rates of transitions are applied to describe the switch of topologies.Finally, a simulation example demonstrates the feasibility of the theory in this paper.

Side-channel attack-resistant AES S-box with hidden subfield inversion and glitch-free masking

A side-channel attack(SCA)-resistant AES S-box implementation is proposed,which is an improvement from the power-aware hiding(PAH)S-box but with higher security and a smaller area.We use the composite field approach and apply the PAH method to the inversion in the nonlinear kernel and a masking method to the other parts.In addition,a delaymatched enable control technique is used to suppress glitches in the masked parts.The evaluation results show that its area is contracted to 63.3%of the full PAH S-box,and its power-delay product is much lower than that of the masking implementation.The leakage assessment using simulation power traces concludes that it has no detectable leakage under t-test and that it at least can thwart the moment-correlation analysis using 665000 noiseless traces.

Timing Attack Analysis on AA_βCryptosystem

Timing attack is an attack on the implementation of a cryptographic primitive. The attack collects leaked secret data via certain implementation techniques either on software or hardware. This paper provides an analysis of a theoretical timing attack on the AAβ algorithm. The attack discussed in this paper gives avenues for secure implementation of AAβ against timing attacks. The simulation of the attack is important to provide invulnerability features for the algorithm in order to be implemented and embedded on applications. At the end of the attack, a method to overcome it will be introduced and it is called AAβ blinding.

An Efficient Method against Side-Channel Attacks on ECC

Side-channel attacks （SCA） may exploit leakage information to break cryptosystems. In this paper we present a new SCA resistant Elliptic Curve scalar multiplication algorithm. The proposed algorithm, builds a sequence of bit-strings representing the scalar k, characterized by the fact that all bit-strings are different from zero; this property will ensure a uniform computation behavior for the algorithm, and thus will make it secure against simple power analysis attacks （SPA）. With other randomization techniques, the proposed countermeasures do not penalize the computation time. The proposed scheme is more efficient than MOEller＇s one, its cost being about 5% to 10% smaller than MOEller＇s one.

A Novel Technique for Detection of Time Delay Switch Attack on Load Frequency Control

In this paper, we focus on the estimation of time delays caused by adversaries in the sensing loop (SL). Based on the literature review, time delay switch (TDS) attacks could make any control system, in particular a power control system, unstable. Therefore, future smart grids will have to use advanced methods to provide better situational awareness of power grid states keeping smart grids reliable and safe from TDS attacks. Here, we introduce a simple method for preventing time delay switch attack on networked control systems. The method relies on an estimator that will estimate and track time delays introduced by an adversary. Knowing the maximum tolerable time delay of the plant’s optimal controller for which the plant remains stable, a time-delay detector issues an alarm signal when the estimated time delay is larger than the minimum one and directs the system to alarm state. In an alarm state, the plant operates under the control of an emergency controller that is local to the plant and remains in this mode until the networked control system state is restored. This method is an inexpensive and simple way to guarantee that an industrial control system remains stable and secure.

Information Theoretic Distinguishers for Timing Attacks with Partial Profiles: Solving the Empty Bin Issue

In any side-channel attack, it is desirable to exploit all the available leakage data to compute the distinguisher’s values. The profiling phase is essential to obtain an accurate leakage model, yet it may not be exhaustive. As a result, information theoretic distinguishers may come up on previously unseen data, a phenomenon yielding empty bins. A strict application of the maximum likelihood method yields a distinguisher that is not even sound. Ignoring empty bins reestablishes soundness, but seriously limits its performance in terms of success rate. The purpose of this paper is to remedy this situation. In this research, we propose six different techniques to improve the performance of information theoretic distinguishers. We study them thoroughly by applying them to timing attacks, both with synthetic and real leakages. Namely, we compare them in terms of success rate, and show that their performance depends on the amount of profiling, and can be explained by a bias-variance analysis. The result of our work is that there exist use-cases, especially when measurements are noisy, where our novel information theoretic distinguishers (typically the soft-drop distinguisher) perform the best compared to known side-channel distinguishers, despite the empty bin situation.

Side-Channel Attacks Based on Collaborative Learning

Side-channel attacks based on supervised learning require that the attacker have complete control over the cryptographic device and obtain a large number of labeled power traces.However,in real life,this requirement is usually not met.In this paper,an attack algorithm based on collaborative learning is proposed.The algorithm only needs to use a small number of labeled power traces to cooperate with the unlabeled power trace to realize the attack to cryptographic device.By experimenting with the DPA contest V4 dataset,the results show that the algorithm can improve the accuracy by about 20%compared with the pure supervised learning in the case of using only 10 labeled power traces.

Modified Adhoc On-Demand Distance Vector for Trust Evaluation And Attack Detection

Recently,Wireless Sensor Network(WSN)becomes most potential technologies for providing improved services to several data gathering and track-ing applications.Because of the wireless medium,multi-hop communication,absence of physical protectivity,and accumulated traffic,WSN is highly vulner-able to security concerns.Therefore,this study explores a specific type of DoS attack identified as a selective forwarding attack where the misbehaving node in the network drops packet on a selective basis.It is challenging to determine if packet loss is caused by a collision in the medium access path,poor channel quality,or a selective forwarding assault.Identifying misbehaving nodes at the earliest opportunity is an acceptable solution for performing secure routing in such networks.As a result,in this study effort,we present a unique Modified Ad Hoc On-Demand Distance Vector(AODV)Routing protocol depending upon the One time password(OTP)method that employs the RSA algorithm.Finally,a trust evaluation process determines which approach is the most optimal.Accord-ing to the simulationfindings of the suggested routing protocol and comparison with existing routing protocols provided in this article,the proposed work is both efficient and cost-effective.

计及DoS攻击和通信时滞的电力系统负荷频率控制

针对电力系统通信网络中存在的时滞和DoS攻击现象,本文提出了基于采样特性的电力系统离散负荷频率控制方案。首先,计及电力系统负荷波动的情况,在多区域电力系统负荷频率控制系统(LFC)模型的基础上,将通信网络中DoS攻击的危害量化为采样信号连续丢失数,并分别考虑通信网络中通信时滞和输出信号采样特性,建立包含输出状态反馈控制器的电力系统LFC模型。其次,基于此模型,利用含有控制命令更新周期、DoS攻击导致的最大采样信号连续丢失数、通信时滞、H_(∞)稳定指标的双边闭环Lyapunov泛函、LMI技术,提出LFC系统满足一定H_(∞)指标的稳定准则,并给出离散状态输出反馈LFC控制器的设计及求解方法。最后,本文以单区域和双区域LFC系统为例进行了仿真验证。结果表明:与已有文献方法相比,本文方法在保持系统H_(∞)渐近稳定前提下,能够容忍更大的通信时滞,且结果的保守性更低;同时可以看出本文所设计的控制器在保证H_(∞)稳定性能的基础上,对一定能量限制的DoS攻击具有弹性的防御性能。因此本文方案的有效性和优越性得到了验证。

盐渍土环境下考虑耐久性损伤的输电塔风振时程分析

长期服役于盐渍土环境下的输电塔耐久性损伤较为严重,当其材料力学性能退化到一定程度时,在强风作用下,输电塔可能会发生破坏,危害线路的安全运行。基于±800kV天中线特高压直流输电工程直线塔,考虑基础钢筋锈蚀、基础混凝土侵蚀、输电塔杆塔钢材锈蚀以及基础箍筋的约束效应,在ABAQUS有限元软件中建立塔-线-基础耦合模型,研究不同风攻角和材料耐久性损伤对塔身动力响应的影响。结果表明:90°风攻角下塔身顺风向位移最大,为最不利风向基本工况;90°风攻角下输电塔塔顶顺风向位移响应贡献主要以背景分量为主,但共振分量也有一定贡献,主要以输电塔1阶振型频率为主,且随着服役时间的增加,振型频率逐渐降低,相应响应的贡献程度逐渐提高;相同风荷载作用下,随着服役时间的增加,塔身位移逐渐增大,相同服役时间下,随着塔身高度的增加,塔身位移响应峰值增长速度变快,结构振动更加明显,材料耐久性损伤对输电塔的位移响应影响较大。

处理器时间侧信道攻防技术综述

现代处理器优化机制众多,设计人员在追求性能提升时,往往忽略背后的安全风险。时间侧信道攻击因其影响面广且隐蔽性好已成为最主要的安全威胁之一。随着瞬态执行攻击的出现,时间侧信道攻击的能力被进一步扩展,计算系统的安全基础被动摇。为此,处理器厂商及安全人员提出了大量防御机制。这些机制具有不同的防护能力及性能开销。与此同时,新的瞬态执行漏洞和隐蔽信道也不断被发现,已提出的防御机制被不断突破。围绕处理器时间侧信道攻防技术的博弈日益激烈。本文从基本攻击原理出发,对现有时间侧信道攻击进行了归纳总结,并在此基础上进一步分析了相关防御机制的保护能力和性能瓶颈,从而梳理出时间侧信道攻防技术的发展趋势,为未来软硬件系统开发和安全技术探索提供参考。

氯盐与硫酸盐复合侵蚀下钢筋混凝土锈裂行为

为评估海洋、盐湖等环境中钢筋混凝土结构耐久性,通过试验与理论相结合探究氯盐与硫酸盐复合侵蚀下钢筋混凝土锈裂特性。通电腐蚀5%(质量分数)NaCl、5%NaCl+5%Na_(2)SO_(4)溶液中钢筋混凝土试件,对比分析混凝土表观形貌、钢筋锈蚀特征。设计伴随的混凝土腐蚀试验,类比保护层腐蚀劣化,分析混凝土力学性能。结果表明:硫酸盐的存在改变胀裂前混凝土形貌,使得单一氯盐侵蚀下的“白须”消失,表面粉化并出现盐结晶,延长胀裂时间;复合侵蚀下钢筋锈蚀率低于单一氯盐侵蚀,二者均显著低于法拉第定律理论值;锈胀裂缝宽度与钢筋锈蚀率线性相关,硫酸盐的存在增大裂缝随钢筋锈蚀发展的速率;通电环境中,受腐蚀混凝土的抗压强度先升高后降低,劈裂抗拉强度不断降低。提出受腐蚀混凝土的抗拉强度演化经验公式。在经典锈胀模型的基础上考虑锈蚀产物对裂缝的填充作用,并将硫酸盐的影响考虑至混凝土抗拉强度、钢筋腐蚀电流密度中,建立复合侵蚀下钢筋混凝土胀裂时间预测模型,并验证了模型的有效性。

基于安全态势监测模型的泛在终端种类攻击自动识别研究

以提升泛在终端种类攻击自动识别精度为目的,研究基于安全态势监测模型的泛在终端种类攻击自动识别方法。对初始数据序列实施等时距处理,依照累加数列所表现出的反“S”形摆动特征,通过灰色Verhulst模型确定泛在终端风险值。将支持向量机的参数与分类精度分别作为改进粒子群算法的粒子和目标函数,通过全局搜索过程确定支持向量机的最优参数,构建多分类识别模型,将泛在终端风险值作为输入,利用识别模型自动识别泛在终端攻击类型。实验分析结果显示该方法攻击类型查准率为97.81%,DCP值最高达到0.0063%。

基于局部检测信息的电力系统时间同步攻击定位方法

卫星时间同步攻击可造成电力系统设备时间紊乱,PMU相角量测错误,危及系统安全运行。鉴于基于线路两端PMU数据的攻击检测方法无法判断线路哪端节点受到攻击,提出了一种基于局部攻击检测信息及同步区域搜索聚合的卫星时间同步攻击定位方法。首先,结合同步攻击特性构建了电力系统等效图及邻接矩阵。其次,结合线路两端攻击检测信息,利用广度优先搜索获取报警线路分割形成的各内部同步的区域子系统。再次,根据子系统是否两两相连分为简单情形和复杂情形;针对复杂情形,结合相角差偏差估计与同步子系统聚合将其转化为简单情形。最后,基于正常节点数量占优假设定位受攻击节点。IEEE 39节点系统测试表明,该方法在不同攻击下可有效定位攻击,可区分受不同攻击的节点,对微小攻击的定位能力强。

基于MGAT-TCN模型的可解释电网虚假数据注入攻击检测方法

新型电力系统背景下,快速、准确的虚假数据注入攻击(FDIA)检测对电网安全运行至关重要。但现有深度学习方法未能充分挖掘电网量测数据的时序和空间特征信息,影响了模型的检测性能;同时,深度神经网络的“黑盒”属性降低了检测模型的可解释性,导致检测结果缺乏可信度。针对上述问题,提出了一种基于多头图注意力网络和时间卷积网络(MGAT-TCN)模型的可解释电网FDIA检测方法。首先,考虑电网拓扑连接关系与量测数据的空间相关性,引入空间拓扑感知注意力机制,建立多头图注意力网络(MGAT)提取量测数据的空间特征;接着,利用时间卷积网络(TCN)并行提取量测数据的时序特征;最后,在IEEE 14节点系统和IEEE 39节点系统中对所提MGAT-TCN模型进行仿真验证。结果表明,所提模型相比于现有检测模型具有更高的检测准确率和效率,且通过拓扑热力图对注意力权值可视化,实现了模型在空间维度的可解释性。

Enhancing non-profiled side-channel attacks by time-frequency analysis

Side-channel analysis(SCA)has become an increasing important method to assess the physical security of cryptographic systems.In the process of SCA,the number of attack data directly determines the performance of SCA.With sufficient attack data,the adversary can achieve a successful SCA.However,in reality,the cryptographic device may be protected with some countermeasures to limit the number of encryptions using the same key.In this case,the adversary cannot use casual numbers of data to perform SCA.The performance of SCA will be severely dropped if the attack traces are insufficient.In this paper,we introduce wavelet scatter transform(WST)and short-time fourier transform(STFT)to non-profiled side-channel analysis domains,to improve the performance of side-channel attacks in the context of insufficient data.We design a practical framework to provide suitable parameters for WST/STFT-based SCA.Using the proposed method,the WST/STFT-based SCA method can significantly enhance the performance and robustness of non-profiled SCA.The practical attacks against four public datasets show that the proposed method is able to achieve more robust performance.Compared with the original correlation power analysis(CPA),the number of attack data can be reduced by 50–95%.