How To Identify And Investigate Timing Channel In LaaS

Covert channel is an information hiding technique that can transmit information bypass the system security policy.It exists in the system and network widely.The timing covert channel is the most threatening type.This channel sends secret information through observing the time interval between adjacent operation.In recent years,with the development of cloud computing,the research of timing channel extends to the cloud platform,cloud platform has the advantage of shared resources,which become a hotbed of timing channel development.Therefore,the research of timing channel in cloud platform have great significance and value to ensure the security of user data and the whole cloud environment.This paper introduced the technical characteristics and the security threats of cloud computing,and expounded the definition and classification of the timing channel under the cloud platform,summarized the signature of timing channel,and analyzed the current research situation and challenges in this field.This paper presents a new analysis dimension for the timing channel,summarized the long-term activity signature of timing channel,designed a recognition algorithms base that.Meantime,it adds evidence collection and analysis module to form forensic framework.This paper implemented a prototype system on the Xen platform.All implementations take advantage of virtual machine management technology to achieve full transparency to the customer's virtual machine,which protects the crime scene and preventing the forensic process from being discovered and taking anti-forensic strategy by the attacker.In order to evaluate the performance of the framework,this paper simulated several timing channels and introduced other similar research methods in our experiments.The experimental result shown better than the order method.The record of the memory activity and the packet record,help reserve the evidence of the crime scene,which is a good basis for the forensic process.