CYBERSECURITYKnocking Cloud Security Off Its Game
Public cloud services employ special security technologies. Computer scientists at ETH Zurich have now discovered a gap in the latest security mechanisms used by AMD and Intel chips. This affects major cloud providers.
Over the past few years, hardware manufacturers have developed technologies that ought to make it possible for companies and governmental organizations to process sensitive data securely using shared cloud computing resources. Known as confidential computing, this approach protects sensitive data while it is being processed by isolating it in an area that is impenetrable to other users and even to the cloud provider. But computer scientists at ETH Zurichhave now proved that it is possible for hackers to gain access to these systems and to the data stored in them.
The researchers ran two attack scenarios, both using what’s known as the interrupt mechanism, which temporarily disrupts regular processing – for instance to prioritize a different computing task. There are a total of 256 different interrupts, and each one triggers a specific sequence of programming commands. “Interrupts are a marginal concern, and it appears that ensuring they have systematic safeguards in place has simply been overlooked,” says Shweta Shinde, Professor of Computer Science at ETH Zurich. Together with her Secure & Trustworthy Systems Group, Shinde identified the problematic vulnerabilities in the server hardware used by two leading manufacturers of computer chips, AMD and Intel.
Eavesdrop-Proof Smartphone Project Helps Find the Gaps
Shinde’s team uncoveredthe security gaps while examining the confidential computing technologies used in AMD and Intel processors. The researchers wanted to gain an in-depth understanding of how these processors function because they are working on an eavesdrop-proof smartphone based on confidential computing.
At the core of confidential computing is the trusted execution environment (TEE). The TEE is a hardware-based component that isolates applications while they are being run. Accessing the application memory is then possible only with an authorized code. This means the data is also protected from unauthorized access while it is being stored, unencrypted, in the working memory during processing. In the past, the only way to ensure such protection was to encrypt data while stored on the hard drive and during transmission.
Instability Factor Number One: Hypervisors
In the public cloud, applications are isolated using a TEE, specifically from what’s known as a hypervisor. Cloud providers use hypervisor software to manage resources ranging from hardware components to their customers’ virtual servers. Hypervisors are an important part of cloud services because they create the required flexibility, efficiency and security. In addition to managing and optimizing how the underlying hardware is used, they ensure that different users can work securely in
