Merwan Mokhtari
email: merwan.mokhtari@univ-rennes1.fr

Philippe Pagnod-Rossiaux

Francois Laruelle

Jean-Pierre Landesman

Alain Moreac

Christophe Levallois

Daniel T Cassidy

Optical characterizations of VCSEL for emission at 850 nm with Al oxide confinement layers

Keywords: VCSELs, reliability, quantum well, oxide aperture, residual stress

In-plane micro-photoluminescence (µ-PL) and micro-reflectivity measurements have been performed at room temperature by optical excitation perpendicular to the surface of two different structures: a complete vertical surface emitting laser (VCSEL) structure and a VCSEL without the upper p-type distributed Bragg reflector (P-DBR). The two structures were both laterally oxidized and measurements were made on top of oxidized and unoxidized regions. We show that since the photoluminescence (PL) spectra consist of the cumulative effect of InGaAs/AlGaAs multi quantum wells (MQWs) luminescence and interferences in the DBR, the presence or not of the P-DBR and oxide layers can modify significantly the spectrum. µ-PL mapping performed on full VCSEL structures clearly shows oxidized and unoxidized regions that are not resolved with visible light optical microscopy. Finally, preliminary degree of polarization (DOP) of the PL measurements have been made on a complete VCSEL structure before and after an oxidation process. We obtain an image of DOP measured by polarization-resolved µ-PL. These measurements allow us to evaluate main components of strain.

INTRODUCTION

Significant advances made in vertical cavity surface emitting lasers (VCSELs) emitting at 850 nm have increased the interest in high speed data communications applications, and particularly in data centers [1]. In this context, these laser diodes, which have been developed for commercial applications, are subject to very stringent performance and reliability requirements. These requirements have direct consequences on the geometry of the semiconductor laser diode, and particularly, specification of the multi quantum wells (MQWs) and cavity mirrors is crucial for good performance. In order to extract important operating parameters, different studies led by T. J. C. Hosea have been performed using spectroscopic characterizations as photo-modulated reflectance for retrieving the optical properties of VCSEL devices and the gain region [2][3]. Today, electrical and optical confinement is achieved by selective wet oxidation of Al x Ga 1-x As (x>0.90) layers within the VCSEL's vertical structure [4][5]. These aluminum oxide (AlOx) layers might constitute the main source of internal stress and these layers might be more critical since they are located close to the active area of the VCSEL [6][START_REF] Helms | Proc. SPIE[END_REF]. Degradation mechanisms have been observed as extended dislocations originating from highly stressed areas pointing to the active region [START_REF] Herrick | [END_REF]. Much work has been done using different nondestructive strain measurements on AlOx confined structures [9][10][11].

In this work, in-plane micro-photoluminescence (µ-PL) and micro-reflectivity measurements were realized along the vertical direction normal to the surface of VCSEL structures in order to characterize the active area. In a second part, preliminary degree of polarization (DOP) of the photoluminescence (PL) measurements have been made on the same complete VCSEL structures. Analysis of the DOP has been shown to be a useful technique for mapping the strain field owing to device processing in GaAs based materials [12]. These first measurements allowed us to evaluate the main components of strain induced by the critical steps of the manufacturing process of the VCSEL structures.

EXPERIMENTAL

The samples for this study are VCSELs structures grown by metalorganic vapor phase epitaxy on (100) GaAs substrates for emission at 850 nm. The Si-doped lower DBR and the C-doped upper DBR are both made of pairs of Al 0.12 Ga 0.88 As / Al 0.9 Ga 0.1 As. The active region is undoped and consists of InGaAs/AlGaAs MQWs to obtain emission at 850 nm. On top of the active area, there are 2 or 4 layers, 15 to 30 nm thick, of Al 0.98 Ga 0.02 As for the oxide confinement. Following the epitaxial growth, the investigated samples were etched by inductively coupled plasma reactive ion etching in order to expose, on the mesa edges, the Al 0.98 Ga 0.02 As layers to oxidizing species. Rectangular and circular shapes of mesas were formed with dimensions from 20 to 250 µm. Some samples were then laterally oxidized. The lateral extension of the Al 0.98 Ga 0.02 As oxidation was measured to be 30 µm for the samples characterized by µ-PL and micro-reflectivity and around 10µm for the samples characterized by DOP. µ-PL measurements were performed at room temperature (RT) under excitation by a CW 633 nm laser source. The PL emission from the sample was collected through a 10 times microscope objective. The spectral resolution of the setup was 0.1 nm whereas the spatial resolution was 2µm. We inserted in the same optical set-up a white light source illuminating the sample perpendicular to its surface to perform reflectivity measurements. DOP characterization was performed using 633nm excitation, at RT. Details on this technique can be found in [13]. We just recall here that the DOP signal measured along direction "y" can be written as:

DOP y = L x -L z L x +L z = -C ε (ε xx -ε zz ) , (1)
where x and z denote the 2 directions perpendicular to y, and therefore belong to the plane of the surface being measured. L x and L z are the components of the spectrally-integrated PL with polarization along these 2 directions. ε xx and ε zz are the linear crystal deformations. C ε is a calibration constant which has been determined experimentally for some GaAs surfaces [12]. Note that in all the figures discussed here, x and z are the horizontal and vertical directions respectively. As shown in [13], the sensitivity of the DOP technique is such that deformations of 10 -5 can be detected. DOP is sensitive to non-biaxial deformations perpendicular to the beam propagation direction, so we can measure only anisotropic strain inside the structure.

RESULTS AND DISCUSSION

A combination of in-plane µ-PL with micro-reflectivity measurements on top of a periodic structure like VCSEL is very useful for understanding the µ-PL spectra [14][START_REF] Schaafsma | MRS Conference Proceedings[END_REF]. PL and reflectivity at RT in the in-plane geometry on top of unoxidized region from a complete VCSEL structure yield the spectrum shown in Fig. 1. For the reflectivity measurements we could not use a reference to normalize the intensity; the approach is then more qualitative than quantitative. We observe maxima in the wavelength range before 830 nm. Nevertheless, around 850 nm, where we expect the MQWs luminescence, we only measure a peak with a very low intensity. We can clearly see that a minimum of reflectivity corresponds to a maximum of PL. The luminescence of the Al 0.12 Ga 0.88 As layers from the P-DBR around 790 nm is filtered by the periodic structure of the VCSEL. The low intensity peak in the PL spectrum at 850 nm is at the same position as the dip in the reflectivity spectrum originating from the Fabry-Perot resonance of the cavity. This shows that most of the excitation is absorbed in the Al 0.12 Ga 0.88 As layers of the P-DBR so we don't excite too much the MQWs. This weak luminescence from the MQWs is then mostly filtered by the highly reflective P-DBR. In this configuration, we cannot determine the luminescence wavelength of the MQWs.

One way to characterize correctly the MQWs is by removal of the P-DBR [14]. We etched away most of the P-DBR layers and deposited a λ/4 thick SiN x layer acting as an anti-reflective coating in order to attenuate the dip of the half cavity. Fig. 2 shows that after etching away most of the P-DBR layers prior to wet oxidation, we can clearly see oxidized and unoxidized regions. Fig. 3 shows the µ-PL and micro-reflectivity spectra of the structure after the removal of most of the mirror layers. We observe that the dip corresponding to the mode of the cavity at 850 nm is now wider and shallower. This is the combined result of the P-DBR removal and the SiN x layer deposited on top of the half cavity. The InGaAs/AlGaAs MQWs PL is now more intense and the real shape of the PL from the MQWs is now observable since a strong degradation of the cavity resonance has occurred. A determination of the PL wavelength is possible. This process can be useful in order to evaluate the PL wavelengths of the MQWs after the growth. However, this method is a destructive and time-consuming technique.

Next we studied the difference between oxidized and unoxidized regions on the complete VCSEL structure. We made both micro-reflectivity and µ-PL measurements on top of the oxidized and unoxidized regions. Fig. 4a and4b show respectively in-plane micro-reflectivity and µ-PL both on top of oxidized and unoxidized regions. From the reflectivity spectra, we can observe that the dip corresponding to the mode of the cavity at 850 nm disappears from measurements on top of the oxidized region. From the µ-PL spectra, we observe the same difference: the small peak corresponding to the MQWs luminescence disappears from measurements on top of the oxidized region. This is explained by the fact that after the oxidation of the Al 0.98 Ga 0.02 As layers into AlOx layers, the refractive index of these layers is almost divided by 2. This process completely changes the cavity properties. In these oxidized areas, the cavity becomes anti-resonant and the resonant mode is then shifted out of the stop-band of the VCSEL.

Based on this observation and this difference between oxidized and unoxidized regions, we performed µ-PL mapping on a large rectangular mesa and we then made a map of the integrated intensity of the MQWs. Fig. 5a and5b show respectively the camera image of the sample and the corresponding µ-PL mapping. We can clearly see oxidized and unoxidized regions that are not resolved with visible light optical microscopy. This method is a non-destructive technique that can be useful in order to identify oxidized and unoxidized regions through the surface.

Finally, we realized preliminary measurements of the DOP of photoluminescence on oxidized and unoxidized circular complete VCSELs structures.

For the unoxidized VCSEL structure, results are shown in Fig. 6. In this configuration, x and z are respectively the horizontal and vertical directions in the planes of the epitaxial layers. We observe that the highest values of DOP are located mainly close to the edges of the structure. Along the vertical axis (z direction), from the edge to the center of the mesa, we can see that the DOP is negative with a pronounced maximum value of the order of 8 % and then becomes positive and decreases. The same trend is observed along the horizontal axis (x direction) but with opposite sign of the DOP values. For a circular mesa, because of the symmetry, we could expect a circular distribution of the strain. Here, we can see that the symmetry is radial and it confirms the assumption. Based on that, along the horizontal axis (x direction) the DOP can be written as:

DOP y = -C ε (ε xx -ε zz ) =-C ε ε xx , (2)
Hence, along the horizontal axis, 8 % DOP converts into a linear deformation ε xx of the order of 1.6x10 -3 (compressive deformation close to the edges). This strain measured in the structure is mainly due to the effect of the etching process that induces crystal deformations. Fig. 7 shows the same measurements after the oxidation process. First, we observe on the PL map that the unoxidized window is not circular as expected but more like a "square shape". This means that the oxidation reaction is not completely isotropic and the velocity of the reaction is different along specific crystallographic directions. Then, on the DOP map, we still have high values of DOP of the order of 10 % (absolute value) close to the edges of the mesa but we also measure strain close to the level of the oxidation fronts. We measure positive DOP along the horizontal axis (x direction) and negative along the vertical axis (z direction) both in the order of 1% (absolute value). These DOP measurements clearly show that the oxidation process induces some non-negligible anisotropic strain at the oxidation fronts in the VCSEL structure.

We performed in-plane micro-PL and micro-reflectivity measurements at RT on laterally oxidized VCSELs structures. We characterized the active area and we showed that since the PL spectrum consists of the cumulative effect of InGaAs/AlGaAs multi quantum wells (MQWs) luminescence and interferences in the DBR, the presence or not of the P-DBR and oxide layers can modify significantly the spectra. After removing most of the top mirror layers and then measuring the in-plane PL, characterization of the active region can be done. Finally, using polarization resolved µ-PL, we realized preliminary DOP measurements on a complete VCSEL structure before and after oxidation. Signatures owing to strain inside the structure are clearly visible. We can see that the etching process and the oxidation process induce anisotropic strain that can be observed with this technique. Further improvements on DOP measurements, finite element simulations, and other characterizations will be investigated to evaluate, with accuracy, processing-induced defects for these components.

FIGURE CAPTION

Fig. 1 .

 1 Fig.1. In-plane PL (blue) and reflectivity (dashed red) spectrums from the complete VCSEL structure on top of the unoxidized region.

Fig. 2 .

 2 Fig. 2. In-plane view of rectangular mesas (550 µm × 230 µm) after etching and SiN x deposition by visible light optical microscopy.

Fig. 3 .

 3 Fig.3. In-plane PL (blue) and reflectivity (dashed red) spectrums from the half cavity on top of the unoxidized region.

Fig. 4 .

 4 Fig. 4. In-plane micro-reflectivity (a) and µ-PL (b) spectrums from the complete VCSEL structure on top of oxidized (black) and unoxidized (dashed red) regions. Inset shows the MQWs luminescence.

Fig. 5 .

 5 Fig. 5. (a) Camera image of two rectangular complete VCSEL structures (550 µm × 230 µm), including lateral oxidation. (b) Corresponding µ-PL cartography of integrated intensity (in counts/s) of the QW luminescence. Bright and dark zones correspond respectively to the unoxidized and oxidized regions.

Fig. 6 .

 6 Fig. 6. Color scale maps of the DOP (a) and PL yield (b) for a 25 µm diameter circular unoxidized VCSEL structure. Measurements are along the normal to the (100) surface. Values for the DOP are indicated in % on the color scale to the right of the map. PL yield is given in counts (color scale to the right of the corresponding map).

Fig. 7 .

 7 Fig. 7. Color scale maps of the DOP (a) and PL (b) yield for a 22 µm diameter circular VCSEL structure after oxidation.

  Fig1

ACKNOWLEDGMENTS

This work was partly supported by the French RENATECH network and by the ScanMAT plateform from Rennes 1 University.


Mohammad-Mahdi Bazm

Marc Lacoste

Mario Südholt

Jean-Marc Menaud

Side-Channels Beyond the Cloud Edge : New Isolation Threats and Solutions

Keywords: cloud security, isolation, side-channel attacks, distributed side-channel attacks, moving target defense, decentralized cloud infrastructures

Fog and edge computing leverage resources of end users and edge devices rather than centralized clouds. Isolation is a core security challenge for such paradigms: just like traditional clouds, fog and edge infrastructures are based on virtualization to share physical resources among several self-contained execution environments like virtual machines and containers. Yet, isolation may be threatened due to side-channels, created by the virtualization layer or due to the sharing of physical resources like the processor. Side-channel attacks (SCAs) exploit and use such leaky channels to obtain sensitive data. This paper aims to clarify the nature of this threat for fog and edge infrastructures. Current SCAs are local and exploit isolation challenges of virtualized environments to retrieve sensitive information. We introduce a new concept of distributed side-channel attack (DSCA) that is based on coordinating local attack techniques. We explore how such attacks can threaten isolation of any virtualized environments such as fog and edge computing. Finally, we study a set of different applicable countermeasures for attack mitigation.

I. INTRODUCTION

Decentralized cloud paradigms have been getting a lot of attention lately, notably because of the emergence of applications involving the Internet of Things (IoT) that generate high volumes of data whose processing requires significant resources. The corresponding novel architectures [START_REF] Bonomi | Fog Computing and its Role in the Internet of Things[END_REF], [START_REF] Lebre | The DIS-COVERY Initiative -Overcoming Major Limitations of Traditional Server-Centric Clouds by Operating Massively Distributed IaaS Facilities[END_REF] extend traditional cloud services beyond data center, migrating virtualization resources to the network edge into different types of micro data centers. Benefits include improved response time and cloud efficiency through geo-location-awareness, e.g., load-balancing between core data centers and the edge, thus enabling multi-level context-aware adaptations.

Both traditional and decentralized clouds make pervasive use of virtualization for dynamic resource allocation, consolidation and service provisioning, reaching an extensive level of physical resource sharing between different operating systems. Virtualization technology has also evolved from virtual machines towards more lightweight solutions such as containers [START_REF] Merkel | Docker: Lightweight Linux Containers for Consistent Development and Deployment[END_REF] or unikernels [START_REF] Madhavapeddy | Unikernels: Library Operating Systems for the Cloud[END_REF], concepts that are better manageable for users, and increase flexibility as well as reliability. Such technologies may be deployed in all elements of the infrastructure, especially on edge computing devices.

They are, however, highly heterogeneous between cloudfacing and embedded-facing parts of the infrastructure. Such features raise several security and privacy issues, some of which are also well-known for traditional vir-D R A F T 2 tualized systems. The most important new challenge is to guarantee strong isolation between virtualized execution environments. Resource isolation between processes or virtual machines is traditionally implemented by OS/hypervisor components using now well-established software techniques, such as access control to limit sharing of key resources. Unfortunately, in a virtualized environment the impact of co-residency on isolation reaches much deeper into the hardware: physical resources are often shared between independent customers at a finegrained level including in terms of multi-tasking through the virtualization layer. This means software security mechanisms can be bypassed, threatening the overall security of the virtualized infrastructure and software systems using it.

Side-channels attacks (SCA) constitute a class of security threats to isolation that is particularly relevant for the emerging "beyond the edge of the cloud" virtualized systems, directly leveraging weaknesses of current virtualization technology. An SCA uses a hidden channel that leaks information on the execution time or on cache access patterns of computations such as cryptographic operations. Such channels can be established based on techniques used in the virtualization layer, the software implementation of cryptographic algorithms, or on micro-architectural vulnerabilities in processors.

SCAs can be applied to a wide range of computing devices and can target particularly cryptographic systems such as AES without need for any special privileged access. For mitigation, countermeasures can be applied at the application, OS/hypervisor, and hardware levels. This paper is organized as follows. In Section II, we give an overview of isolation challenges related to virtualization. In Section III, we define SCAs, and survey SCA types in virtualized environments, along with some typical attack and mitigation techniques. Then, we introduce DSCAs which are performed in a distributed manner by coordinating the attack techniques. In Section IV, we discuss possible approaches to mitigating attacks at different levels of application. Then, in Section V, we give an outlook of the approach Moving Target Defense (MTD) in dencetralized clouds infrastructures.

Finally, we conclude in Section VI with some perspectives.

II. VIRTUALIZATION: BREAKING ISOLATION?

Virtualization is in some respects strongly at odds with isolation, both at the hardware level and at the software level. On the one hand, the virtualization layer D R A F T 3 enables several virtual machines to run concurrently on a physical machine. VMs are distributed between processor physical cores, where they are scheduled and run. The low-level physical resources of the host are broadly shared between VMs through the virtualization layer, which has a strong security impact on running VMs. On the other hand, a number of techniques in the virtualization layer make the use of some physical resources (the main memory and caches, in particular) more efficient. Yet, they may also strongly threaten isolation. These techniques may have an impact on isolation directly or indirectly (Table. I).

A. Hardware Isolation Challenges

The processor is the primary resource shared among VMs/containers in different ways. Several features of current micro-architectures may cause isolation violations.

1) Cache Architecture and Multi-Cores: Because of rising performance needs for processing resources, multi-core processors are widely used in virtualized environments. Cache memory is a fast and small amount of memory speeding up access times between the processor and, the main memory.

We may distinguish 3 levels of cache (see Fig. 1 and L2 (KBs). A cache is organized into sets containing several cache lines, or data blocks of fixed size which are the units of data transfer between the CPU and the RAM. When the processor needs to access a specific location in the RAM, it checks whether a copy of the data is already present in L1, L2 or LLC. If so (cache hit), the CPU performs operations on the cache in a few clock cycles. Otherwise (cache miss), the CPU fetches data from the RAM into the cache taking more clock cycles. Such timing differences (or more generally access patterns) may be observed by an attacker. The cache hierarchy, especially the shared LLC, can thus be exploited as a channel leaking information on running processes e.g., between different cores.

2) Exclusive/Inclusive Caches: Two types of cache architecture can be distinguished in modern processors.

In exclusive caches, each cache line is not replicated in the different cache levels, thus obtaining higher capacity.

In the case of inclusive cache architectures, all cache lines at a given cache level (e.g., L1 and L2) are also available at the lower-levels of cache (e.g., LLC).

Inclusive architectures provide less cache capacity but offer higher performance. Unfortunately, they are widely exploited in cache-based SCAs: when a cache line is evicted from the LLC, it is also evicted from the L2 and L1 caches. An attacker can then simply evict cache lines from the LLC, and measure fetching time of a memory line from RAM to obtain the victim's cache access pattern to perform an SCA.

3) Simultaneous Multi-Threading (SMT): Simultaneous multi-threading such as Intel Hyper-Threading (HT), enables multiple threads to be run in parallel on a single core of a processor in order to improve execution speed. SMT allows sharing of dedicated resources of a core, mainly its L1 cache, between multiple threads running on the same core. This sharing can leak information between threads (of a core) and may be used by a spy thread to gather information from other threads. SMT can potentially ease cache-based SCAs [START_REF] Demme | Side-Channel Vulnerability Factor: a Metric for Measuring Information Leakage[END_REF], [START_REF]Cache Missing for Fun and Profit[END_REF].

B. Virtualization Layer Isolation Challenges

The virtualization layer provides important isolation services between VMs. Unfortunately, some mechanisms in this layer can also be abused for isolation violations.

1) Memory Deduplication:

This mechanism is widely used in OSes and hypervisors to optimize memory usage [START_REF] Arcangeli | Increasing Memory Density by using KSM[END_REF]. Duplicated physical pages are merged, and mapped into virtual address spaces of the processes using them. This technique breaks isolation between two processes that may thus access the same physical memory pages [START_REF] Suzaki | Memory Deduplication as a Threat to the Guest OS[END_REF].

2) Large-Page Memory Management: Large pages enable more efficient memory management in the hypervisor: access to large pages boosts Translation Lookaside Buffer (TLB) page walks during address translation by reducing the number of page table entries. Unfortunately, this technique has a security impact as in large-page memory management, more bits of a virtual address remain unchanged during the page mapping to a physical address than small-page memory management [START_REF] Apecechea | Jackpot Stealing Information from Large Caches via Huge Pages[END_REF]. 3) Non-Privileged Access to Hardware Instructions: Many hypervisors do not perform any access control to execute instructions on the host. Almost all SCA techniques exploit specific hardware instructions such as rdtsc or clflush, respectively to measure time, and to evict memory lines from the cache. Such instructions may be used without any special privileges by an attacker to manipulate the state of the cache.

III. DISTRIBUTED SIDE-CHANNEL ATTACKS IN VIRTUALIZED PLATFORMS

Recently, the idea of a distributed timing attack (DTA) was proposed in the context of network-on-chips (NoC) [START_REF] Sepúlveda | NoC-Based Protection for SoC Time-Driven Attacks[END_REF]. This environment is not virtualized, but as we will show, SCAs may be performed in a distributed way on virtualized platforms. In what follows, we first present SCAs and attack techniques through an example.

We then introduce a new concept of SCA, distributed side-channel attacks, that combine such techniques.

A. Side-Channels

A side-channel is a hidden information channel that differs from traditional "main" channels (e.g., files, network) in that security violations may not be prevented by placing protection mechanisms directly around data.

They usually come from indirect effects of computations and are thus much more elusive. Such channels may be created through hardware, e.g., in some components of the micro-architecture, such as the processor cache hierarchy. They may also be created through software, In timing attacks, time is the leaky channel used to retrieve sensitive information such as secret keys.

The attacker attempts to analyze the time taken to execute cryptographic algorithms. Cache-based timing attacks [START_REF] Weiß | A cache timing attack on aes in virtualization environments[END_REF], [START_REF] Acıic ¸mez | Cache based remote timing attack on the aes[END_REF] leverage cache memory as a means to attack a cryptosystem. As an example, consider an attack implemented on DES encryption by inferring Sbox inputs [START_REF] Tsunoo | Cryptanalysis of des implemented on computers with cache[END_REF]: the encryption time is measured for different plaintexts. The execution time of an encryption algorithm may also vary due to its memory activity.

Cache misses notably increase the execution time of an application at run-time.

In cache-based side-channel attacks, the shared cache itself leaks information. Two broad classes of attacks should be distinguished. In access-driven attacks [START_REF] Gruss | Flush+ Flush: A Fast and Stealthy Cache Attack[END_REF], [START_REF] Yarom | Flush+Reload: A High Resolution, Low Noise, L3 Cache Side-Channel Attack[END_REF], the attacker tries to find any relation between an encryption process and accessed cache lines to exploit the pattern of cache accesses of the victim. To derive a profile of cache activities, the attacker manipulates the cache by evicting memory lines of the victim process. The attack is performed in three main steps: (1) the attacker fills one or several selected cache sets -he selects more likely cache sets to be accessed by the victim;

(2) the attacker waits for a defined period while the cache is used by the victim process; (3) the attacker refills memory sets with the same data used in step [START_REF] Bonomi | Fog Computing and its Role in the Internet of Things[END_REF] to verify which cache lines are accessed by the victim.

Indeed, if a memory line was flushed by the victim from the cache, it takes more CPU cycles to fetch the line from main memory when it is re-accessed.

Otherwise, the line is already in the cache, thus requiring fewer CPU cycles. This timing difference is exploited to profile cache access patterns of the victim.

To defend against such attacks, a distributed computing technique such as Secure Multi-Party Computation [START_REF] Goldreich | Secure multi-party computation[END_REF] may be considered as a mitigation approach to SCAs by dividing computations among a certain number of computing resources, and securing them by e.g., a

D R A F T

C. Distributed Side-Channel Attacks (DSCA)

A DSCA aims to retrieve sensitive information, or a subset of it, from a number of computing resources of a distributed system, where each computing resource performs processing of a part of the overall system activity. The retrieved information may, for instance, be a set of encryption keys that can be exploited to compromise the functionality of the whole distributed system (see Fig. 3). In the following, we provide the (first) definition of distributed side-channel attacks applicable to such a class of key recovery schemes. • S S S is a distributed system;

• M vic M vic M vic are the VMs/containers that are targeted by the attack;

• D D D is the distributed dataset to be compromised (partially or totally);

• K K K is the distributed cryptographic secret to retrieve;

• M mal M mal M mal are malicious VMs, co-located with the victim VMs;

• A A A is a set of local SCA techniques;

• CP CP CP is a protocol to coordinate the attacker VMs in

M mal M mal M mal ;
• EP EP EP is a protocol to exfiltrate data.

We VMs/containers (see Fig. 4). Each node of the set may then apply on its co-located victim VM/container a sidechannel attack using one of the techniques described in Section III. After a number of attacking nodes obtain their target sub-keys, results may be sent using an exfiltration protocol to a centralized attack server that will rebuild the overall secret key from received results. Otherwise, the attacker will not be able to profile the cache activity of the victim application. How to perform effectively but stealthy synchronization is very important in the implementation of side-channel attacks.

D R A F T

We Actually, existing mitigation approaches may be divided into three main broad classes according to the enforcement layer in the infrastructure: enforcement on the application, system, and hardware levels. All approaches impose significant performance overheads.

The best counter-measure is the one that offers robust security with minimal performance degradation while being scalable and applicable to existing infrastructures with little modifications. Application-level solutions may be applied to achieve secure-by-design protection of applications running in a virtualized environment such as cloud while they are purely static. Hardware approaches are mainly static and focus on applying security in the design of hardware such as processors. They can influence the design of CPUs such as those from ARM that are widespread in fog/edge computing devices.

Research on system (i.e., OS and hypervisor) approaches are currently getting more attention because of their benefits in terms of dynamicity and compatibility with D R A F T legacy systems. Furthermore, they are applicable both in classic clouds and decentralized ones such as fog computing.

A. Application-Level Approaches

This class of approaches focuses on improving the security of sensitive applications by secure design and implementation. Design-oriented solutions aim to improve side-channel attack resistance of applications.

Development-oriented and code optimization solutions

propose new programming methods for the secure implementation of cryptographic algorithms.

For timing attacks, information leakage comes from variations in execution time of applications, either due to instructions or operations with variable execution time or to data-dependent branches in the implementation. Using instructions with a constant execution time [START_REF] Gopal | Fast and constant-time implementation of modular exponentiation[END_REF] and eliminating conditional branches and loops dependent on secret input data [START_REF] Rivain | Provably secure higher-order masking of aes[END_REF], [START_REF] Osvik | Cache attacks and countermeasures: the case of aes[END_REF] can help to improve SCA resistance of an application. Code transformation techniques for software protection [START_REF] Barthe | Preventing timing leaks through transactional branching instructions[END_REF] is another approach to mitigate timing SCAs, notably through compilerbased techniques [START_REF] Cleemput | Compiler mitigations for time attacks on modern x86 processors[END_REF], [START_REF] Coppens | Practical mitigations for timing-based side-channel attacks on modern x86 processors[END_REF]. Key-dependent control flow and data flow are the main causes of timing variations and correlation between secret data and execution time. Therefore, the compiler may be modified to eliminate branches to cut any such correlation using an if-conversion transformation [START_REF] Coppens | Practical mitigations for timing-based side-channel attacks on modern x86 processors[END_REF]. For cache attacks, obfuscation of cache access patterns from secret data is a possible mitigation technique [START_REF] Osvik | Cache attacks and countermeasures: the case of aes[END_REF], [START_REF] Bernstein | Cache-timing attacks on aes[END_REF]. Unfortunately, the overhead of such techniques remains high.

B. OS-Level Approaches

SCA mitigation is also possible at the OS-level through different mechanisms. This level of mitigation might be more interesting than application-layer solutions, as fewer modifications are needed to the infrastruc-ture -although the guest OS needs to be updated. Time padding, cache cleansing, dynamic partitioning [START_REF] Braun | Robust and efficient elimination of cache and timing side channels[END_REF],

cache locking and multiplexing cache lines [START_REF] Kim | STEALTHMEM: System-Level Protection Against Cache-Based Side Channel Attacks in the Cloud[END_REF] are a number of possible countermeasures. Time-padding ensures that the execution time of a protected application is independent of its input data. Thus, an attacker is unable to observe any variation in the execution time of a function. Cache cleansing flushes the cache to prevent from obtaining cache state information after execution of a function. Cache partitioning, cache locking, and multiplexing of cache lines protect resources of a trusted process from an untrusted process during its execution.

Safe scheduling is also an efficient technique against timing side-channels [START_REF] Zhang | Duppel: Retrofitting Commodity Operating Systems to Mitigate Cache Side Channels in the Cloud[END_REF].

C. Hypervisor-Level Approaches

This level of mitigation could be more effective than the OS layer as cloud providers do not need to modify the guest OS. All OS-level mechanisms may also be implemented at the hypervisor level. Safe scheduling-related approaches include configuring the scheduler to prevent cross-VM SCAs [START_REF] Varadarajan | Scheduler-based defenses against cross-vm side-channels[END_REF]: malicious VMs tracing victim VMs may be interrupted using the ratelimit_us parameter in Xen and KVM that determines the minimum run-time of a virtual CPU (VCPU) allocated to a physical CPU. A related approach, applicable in a cloud environment is based on VM migration [START_REF] Zhang | Incentive compatible moving target defense against vm-colocation attacks in clouds[END_REF]: the scheduler prevents a malicious VM from spying on a victim VM by moving it away to other physical hosts in the cloud.

Page coloring is another technique that assigns a specific color to the memory pages of each VM. It then maps pages with the same color to a fixed set of cache lines, which are only accessible to related VMs. This technique is applicable both statically [START_REF] Xinxin | A simple cache partitioning approach in a virtualized environment[END_REF] and dynamically [START_REF] Shi | Limiting cache-based side-channel in multi-tenant cloud using dynamic page coloring[END_REF]. Static page coloring degrades the Hypervisor may also be used as interceptor between

VMs and hardware to control some hardware instructions used in SCAs such as rdtsc. Vattikonda et al. [START_REF] Vattikonda | Eliminating Fine-Grained Timers in Xen[END_REF] proposed an approach called fuzzy time based on degrading the timing resolution of rdtsc: without fine-grained timing information, it becomes hard for the attacker to detect cache hits/misses.

D. Hardware-Level Approaches

Hardware-based mitigation for instance explores integrating cryptographic security in processor design.

Solutions also include enhancing cache architectures

with new security mechanisms such as locking of cache lines [START_REF] Kong | Deconstructing new cache designs for thwarting software cache-based side channel attacks[END_REF], random permutation techniques [START_REF] Kong | Deconstructing new cache designs for thwarting software cache-based side channel attacks[END_REF], and cache partitioning [START_REF] Liu | Catalyst: Defeating last-level cache side channel attacks in cloud computing[END_REF] to provide strong isolation between processing units i.e., threads and VMs. Recently, Intel introduced a new technology called Cache Allocation Technology (CAT) [START_REF] Intel | Improve Real-Time Performance Utilizing Cache Allocation Technology[END_REF] in its processors to improve performance of latency-sensitive applications by guaranteeing cache capacity to priority applications.

This technology enables dynamic LLC partitioning between processor cores, from OS/hypervisor layer. Unfortunately, while very efficient and providing strong isolation, hardware mitigation approaches suffer from compatibility issues with mainstream platforms.

E. Moving Target Defense Approach Using Cloud

Scheduler

Moving Target Defense (MTD) [START_REF] Zhuang | Towards a theory of moving target defense[END_REF] is based on the changing of the system configurations using techniques such as randomization, in order to make attack surface dynamic and consequently harder to exploit by attackers. This approach may be applied to mitigate DDOS attacks [START_REF] Wright | Moving target defense against ddos attacks: An empirical gametheoretic analysis[END_REF] or co-residency attacks such as side-channel ones [START_REF] Moon | Nomad: Mitigating arbitrary cloud side channels via provider-assisted migration[END_REF]. To perform any sidechannel attacks, an attacker must co-localize a malicious instance e.g., an attacker VM with the victim VM, by reverse engineering of the VM placement algorithm in IaaS cloud. The MTD approach aims to leverage the cloud scheduler in order to migrate a malicious/victim virtualized instance to another host in the cloud.

Generally, there are two classes of VM placement algorithms: centralized and fully-distributed (see Fig. 5). Centralized algorithms [START_REF] Hermenier | Entropy: a consolidation manager for clusters[END_REF] may be leveraged to mitigate side-channel attacks in a uniform cloud i.e., a cloud operated by a service provider such as Amazon, and fully-distributed algorithms [START_REF] Quesnel | Cooperative and reactive scheduling in large-scale virtualized platforms with dvms[END_REF] for multi-cloud where:

• CI CI CI is the cloud infrastructure;

• N N N are nodes/hosts in the cloud infrastructure;

• P LC P LC P LC is a cloud placement algorithm;

• M vic M vic M vic are the VMs/containers that are targeted by the attack;

• M mal M mal M mal are malicious VM(s)/container(s), co-located with the victim VM(s)/container(s);

• DT C DT C DT C is a detection technique;

• A A A is a side-channel attack.

We consider a cloud infrastructure CI CI CI composed of As a solution to improve the performance of the MTD framework in the case of co-residency attacks such as side-channel ones, it may be extended to a local MTD on a physical host with NUMA (see Fig. 6) architecture with several processors, by leveraging hypervisor/OS scheduler. For instance, if a host has two processors, once a side-channel attack is detected between two instances on one of the processors, local MTD will be applied to the malicious instance by moving it to the second processor. In such scenario, the efficiency of the overall system will be raised because of none migrating the instance between physical machines in the virtualized infrastructure.

j j j nodes N = N 1 , N 2 , ..., N j N = N 1 , N 2 , ..., N j N = N 1 ,

D R A F T

  Each level of mitigation comes with its own challenges in terms of characteristics such as performance and compatibility with legacy platforms. Despite having been already well investigated separately for cloud and for embedded systems, SCAs are still far from understood overall for decentralized virtualized systems. For instance, SCAs may be performed in a distributed and coordinated manner to attack several targets in a virtualized environment such as a fog infrastructure, giving rise to new forms of attacks: Distributed SCAs (DSCAs). However, no definition and systematic study of such DSCAs has been put forward yet. This paper provides a first definition of DSCAs. It also aims to clarify the nature of this threat in terms of challenges and types of attacks, and presents possible counter-measures for mitigation. We provide the following contributions: (1) we identify isolation challenges related to virtualization, and show how they have been exploited in already known SCAs; (2) we introduce the concept of distributed SCAs which may exploit targets using several coordinated local SCAs; (3) we present three possible levels for mitigation, giving a brief overview of different proposed approaches.

Figure 1 :

 1 Figure 1: Common cache architecture in virtualized systems.

5 B

 5 e.g., by techniques in the virtualization layer to optimize resource usage such as memory deduplication. Table. II shows different leaky channels in the virtualization technologies. . Side-Channel Attacks A side-channel attack (SCA) exploits a side-channel to obtain important information. SCAs may be classified according to the type of exploited channel. Timing attacks and cache-based attacks are two main classes of SCAs, where the processor cache memory is often exploited by adversaries to obtain sensitive information such as cryptographic secret keys.

Figure 2 :

 2 Figure 2: Prime+Probe side-channel attack: main three steps of the technique.

  over a set M vic M vic M vic of VMs running in a distributed system S S S is defined as the tuple DSCA = (S, M vic , D, K, M mal , A, CP, EP ) DSCA = (S, M vic , D, K, M mal , A, CP, EP ) DSCA = (S, M vic , D, K, M mal , A, CP, EP ) where:

  consider D = d 1 , ..., d n D = d 1 , ..., d n D = d 1 , ..., d n a dataset to be processed by the distributed system S = s 1 , ..., s n S = s 1 , ..., s n S = s 1 , ..., s n implemented on a set of virtual machines M vic = m vic1 , ..., m vicn M vic = m vic1 , ..., m vicn M vic = m vic1 , ..., m vicn on a virtualized platform. Each component s i s i s i of S S S processes data d i d i d i locally and runs in its own virtual machine m vici m vici m vici . We assume data protection is based on a shared cryptographic scheme with secret-key K = k 1 , ..., k n K = k 1 , ..., k n K = k 1 , .

2 )Figure 3 :

 23 Figure 3: Overall view of the distributed system. Each component of the system has a sub-key to protect data.

Figure 4 :

 4 Figure 4: Malicious VMs co-located with victim VMs. The attack coordination is performed by a botnet under adversary control.

  are performed across the networking infrastructure, relevant countermeasures may already be applied locally on physical machines. However, the design and implementation of a federative mitigation framework leveraging approaches such as Moving Target Defense (MTD) [24] looks quite promising in terms of avenue for research. In addition to overcoming the underlying sources of heterogeneity, this type of autonomic security framework may decide that selected countermeasures i.e., dynamic ones may be applied on different hosts, for instance, according to available resources or performance, thus enabling trade-offs between protection and other nonfunctional properties.

Figure 5 :

 5 Figure 5: Fully-distributed scheduling vs centralized one.

  and decentralized cloud infrastructures such as Fog computing. There are different types of placement algorithm in cloud such as Round Robin, Greedy, Genetic algorithms. Each algorithm tries to guarantee some particular properties such as load balancing among D R A F T servers, minimum number of active hosts, least response time, to avoid SLA violation in the cloud platform.Furthermore, a cloud scheduler takes two placement decisions[START_REF] Mills | Comparing vmplacement algorithms for on-demand clouds[END_REF]: Instance initialization (when an instance is created, the scheduler decides to allocate the instance to a host in the infrastructure, according to the instance placement policy), and Instance migration (when an instance is migrated between hosts in infrastructure to guarantee SLA). For instance, in side-channel attacks, the instance initialization decision plays a preventive role in co-residency attacks by avoiding a malicious instance to be co-localized with a targeted victim instance on the same physical machine. This phase of VM placement algorithm is undocumented for security reasons by cloud service providers. The migration decision may be leveraged to mitigate co-residency attacks such as side-channel ones when the attack is detected. Thus, this part of the placement algorithm gets attention in a moving target defense approach. Such mitigation approach may be extended by a detection module to increase efficiency. Thus, an MTD approach may be defined as following: Definition. A MTD mitigation approach over a set N N N of nodes that run a set of VMs/containers is defined as the tuple M T D = (CI, N, P LC, M vic , M mal , DT C, A) M T D = (CI, N, P LC, M vic , M mal , DT C, A) M T D = (CI, N, P LC, M vic , M mal , DT C, A)

  are done in a coordinated way or in a centralized manner, in any cloud architecture i.e., centralized or decentralized. Design and implementation of a moving target defense mitigation framework may be different according to the cloud architecture. Handling a migration event is completely dependent on the cloud scheduler architecture i.e., distributed or centralized. Furthermore, the efficiency of the MTD platform is strongly based on the performance of the placement algorithm. This topic gets more importance in large-scale infrastructures such as Fog that are composed of several thousands of nodes distributed in different locations. Thus, as much as the placement algorithm is scalable to large infrastructures, it should also be reactive in order to guarantee SLA (e.g., VM resource requirements) rapidly, to reduce the trade-off between security and performance in the cloud infrastructure.

Figure 6 :

 6 Figure 6: A NUMA architecture with two CPUs in a VM-based environment.

Table II :

 II Side-channels in different virtualization technologies.In trace-driven attacks[START_REF] Acıic | Trace-driven cache attacks on aes (short paper)[END_REF],[START_REF] Gallais | Improved tracedriven cache-collision attacks against embedded aes implementations[END_REF], the attacker observes cache activities i.e., memory lines which are accessed by an encryption process during its execution in order to obtain a sequence of cache hits and cache misses.

	For example, observing which memory accesses to a
	lookup table lead to cache hits allows finding indices
	of entries in the table.
	Different techniques have been proposed to perform
	a cache-based SCA. For instance: Prime+Probe [18],
	Flush+Reload	[15],	Flush+Flush	[14]	and
	Evict+Time [19]. Prime+Probe (see Fig. 2) is the
	most common technique to obtain a profile of a victim

VM or process through a shared cache. The attacker needs to monitor which cache lines are accessed by the victim during the execution of sensitive operations such as encryption using timing information (usually provided by hardware instructions such as rdtsc).

  consider t victim t victim t victim : start time of a sensitive operation

	e.g., cryptographic, t attack t attack t attack : start time of spy operation
	(tracing cache activities of victim) , and t wait t wait t wait : waiting
	period in the phase 2 of any side-channel attack. In
	order to detect the first access of sensitive operation
	in sensitive application running in s i s i s i , t victim t victim t victim must
	For instance, synchronization in Flush+Reload is less
	difficult because of high resolution of technique that uses
	page sharing. In a real attack scenario, the spy applica-
	tion (running in malicious VM/container) must be able
	to recognize the start of the victim application (running
	in the victim VM/container). Achieving synchronization

be : t attack < t victim < t attack + t wait t attack < t victim < t attack + t wait t attack < t victim < t attack + t wait . The attacker may probe cache periodically to detect any cache access by the sensitive operation. However, getting synchronized with the victim depends on the attacks techniques. between two containers running on the same CPU core, in the case of Prime+Probe attack on L1 cache is simpler because of the reduced level of noise in L1.

  N 2 , ..., N j , which are distributed in different sites i.e., large or small data centers. In such infrastructure, as a preventive countermeasure, the goal of the initial step of the placement algorithm is to prevent m mali m mali m mali and m vici m vici m vici to be co-localized on node N i N i N i to avoid meeting any co-residency conditions to perform side-channel attack A A A between m mali m mali m mali and m vici m vici m vici . As a reactive countermeasure, the MTD approach aims to react to the detection of side-channel attack A A A between m mali m mali m mali and m vici m vici m vici which are co-resident in the same node N i N i N i , by migrating m mali m mali m mali to another node N k N

k N k in the infrastructure.


Mohammad-Mahdi Bazm
email: mohammadmahdi.bazm@orange.com

Thibaut Sautereau
email: thibaut.sautereau@orange.com

Marc Lacoste
email: marc.lacoste@orange.com

Mario Südholt
email: mario.sudholt@imt-atlantique.fr

Jean-Marc Menaud
email: jean-marc.menaud@imt-atlantique.fr

Cache-Based Side-Channel Attacks Detection through Intel Cache Monitoring Technology and Hardware Performance Counters

Keywords: side-channel attacks detection, Intel cache monitoring technology, hardware performance counters, cloud security, isolation

Research on cache-based side-channel attacks shows the security impact of these attacks on cloud computing. Therefore, the detection of cache-based sidechannel attacks has received more attention in IaaS cloud infrastructures because of improvements in the attack techniques. However, such detection requires high resolution information, and it is also a challenging task because of the fine-granularity of the attacks. In this paper, we present an approach to detect cross-VM cache-based side-channel attacks through using hardware fine-grained information provided by Intel Cache Monitoring Technology (CMT) and Hardware Performance Counters (HPCs) following the Gaussian anomaly detection method. The approach shows a high detection rate with 2% performance overhead on the computing platform.

This paper is organized as follows. In Section ??,

we give an overview on existing approaches. Then, in

Section II, we provide some background on the cache architecture in processors and on cache-based side-channel attacks. In Section III, we give an overview on the design and implementation of the approach. In Section IV, we evaluate the implemented prototype. Finally, we conclude with some perspectives in Section V. traffic between cores and the processor sockets [START_REF] Thomadakis | The architecture of the nehalem processor and nehalem-ep smp platforms[END_REF].

II. RELATED WORK

Inclusiveness provides less cache capacity but offers higher performance to the processor.

B. Cache-based Side-channel Attacks

The I gives an overview of several hardware cache events that might be utilized in the detection of cache-based side-channel attacks in the system. For real-time attack detection, the detection module should simultaneously get access to events.

Therefore, we select the most effective events among those available for the attack detection. The detection module aims to detect any malicious behavior induced by a virtual machine, in the cache. We thus focus on the events which are necessarily related to the LLC. Previous works [START_REF] Chiappetta | Real time detection of cache-based side-channel attacks using hardware performance counters[END_REF] [6] [START_REF] Gruss | Flush+ flush: a fast and stealthy cache attack[END_REF] proposed to focus on LLC-misses and LLC-references as the important events to monitor. After our observation during experimentation, in our approach, we use LLC-misses, LLC-references, iTLB-cache-misses, and iTLB-r-accesses as the most effective performance counters to detect the attack.

c) Anomaly Detection: As an application class of Machine Learning, the Gaussian anomaly detection approach detects data points in a data set which do not fit well with the rest of the data set. This approach is widely used in monitoring and diagnostic applications.

Given a data set X with m data points. Each data point

x (i) in the X is represented by n features. Among data points in the data set, there might be some anomalous data points to detect. The first step in the Gaussian method is to fit a Gaussian distribution to data points of data set. We thus calculate the mean (µ j ) and the variance (σ 2 j ) of each feature j = 1, . . . , n for x Finally, according to a defined threshold value based on a cross-validation, we can find anomalous data points through calculating the probability of each data point (p(x (i) )) and finding those with lower probability value than threshold. To find an optimal threshold, we use a cross-validation set and calculate the F 1 -score [START_REF] Powers | Evaluation: from precision, recall and f-measure to roc, informedness, markedness and correlation[END_REF] for each example in the set. We calculate the F 1 -score using the precision (prec) and recall (rec), where tp is the number of true positives, fp is the number of false positives, and fn is the number of false negatives.

p(x; µ, σ 2 ) = 1 √ 2πσ 2 e -(x-µ) 2 2σ 2 (1)
F 1 = 2. prec.rec prec + rec prec = tp tp+fp rec = tp tp+fn (2)
In our detection approach, each virtual machine is represented as a data point in the data set, and performance information such as LLC-misses and llc-occupancy are the features of each data point.

We apply Gaussian anomaly detection on the data set to detect any anomalous VM. As there is a limited number of running VMs on a physical machine, the data set size remains small and will efficiently reduce the computation cost of the anomaly detection module. LLC occupancy (Byte) will explore improving our approach, also comparing it with emerging approaches for side-channel attacks detection.

C. Implementation

A tt a c k e r V ic ti m C IW -V M V M 1 V M 2 V M 3 0.2 0.4 0.6 0.8 1 1.2 1.4 1.6 •10 5 A tt a c k e r V ic ti m C IW -V M V M 1 V M 2 V M 3 1 2 3 4 •10 5 A tt a c k e r V ic ti m C IW -V M V M 1 V M 2 V M 3 0 1 2 3 •10 5 A tt a c k e r V ic ti m C IW -V M V M 1 V M 2 V M 3 0 2,000 4,000 6,000 (a) no attack, no CIW Number of event A tt a c k e r V ic ti m C IW -V M V M 1 V M 2 V M 3 0 1 2 3 4 5 •10 5 (b) attack, no CIW A tt a c k e r V ic ti m C IW -V M V M 1 V M 2 V M 3 0 0.5 1 1.5 •10 5 (c) no attack, CIW A tt a c k e r V ic ti m C IW -V M V M 1 V M 2 V M 3 0 1 2 3 4 •10 5 (

A F T 2 (

 2 allocation of hardware resources among virtual instances such as virtual machines (VMs) with different operating systems. However, this layer has shown several security issues related to itself and virtualized instances. Although, the virtualization layer provides isolation, one new challenge is to guarantee strong isolation between virtualized instances running on top of the virtualization layer. OS and hypervisor traditionally implement resource isolation between processes or VMs using software/hardware techniques, such as memory management and access control to key shared physical resources. However, sharing hardware resources has an impact on isolation in virtualized environments. Furthermore, physical resources are often shared between independent users at very low-level through the virtualization layer. Such sharing allows bypassing security mechanisms implemented at virtualization layer, breaking isolation, and threatening the security of the overall virtualized infrastructure. Side-channel attacks D R SCA) threaten isolation of virtualized environments. These attacks use a leaky channel to obtain secret information such as cryptographic keys. Such channels are either established through techniques or optimization mechanisms e.g., memory deduplication used in the virtualization layer, or micro-architectural vulnerabilities in processors. The threat of side-channel attacks is becoming a security concern in cloud computing [?]. For instance, in IaaS platforms, a CPU cache which is shared between VMs leaks information on cache access patterns of running instances (cross-VM side-channel attacks). The Last-Level Cache (LLC) is one of resources shared among all cores of processor, and leaks cache access patterns of a VM running on another processor core than adversary [2] [3]. To obtain cache access patterns, an adversary does not need to any special privileged access. This is why these attacks gained attention in cloud infrastructures. Detection of side-channel attacks is hard because of relying on fine-grained information without exploiting special security barriers. These attacks may be detected at OS/hypervisor level through fine-grained information which are often provided by Hardware Performance Counters (HPCs): special platform hardware registers used to store statistics about various events of the processor (e.g., number of cache misses). Existing approaches [4] [5] [6] use only HPCs as the source of raw information in their works to detect cache-based side-channel attacks. However, other hardware technologies such as Intel Cache Monitoring Technology (CMT) providing fine-grained information on the cache behavior of a virtual machine, might be useful to improve the precision of detection approaches. In this work, we present a cross-VM side-channel attacks detection approach. It leverages Intel CMT and HPCs to detect side-channel attacks conducted between two VMs through the LLC. We made the following contributions: (1) we present a prototype to detect side-channel attacks using HPCs and Intel CMT for the first time; (2) we introduce the concept and implementation of the prototype; (3) we evaluate the prototype in terms of security and performance characteristics.

  virtualization layer enables running multiple VMs on a physical machine. Main physical resources of the host such as CPU and RAM are shared between VMs through the virtualization layer, which has a strong security impact on running VMs. Furthermore, such sharing is strongly at odds with isolation, both at the hardware level and at the software level. To make better use of shared resources, some optimization techniques such as memory page deduplication are used in the virtualization layer. These techniques may have an impact on isolation directly or indirectly. In such environment, processor's caches and especially the LLC are shared among running VMs or virtualized instances. These caches are widely exploited through cache-based side-channel attacks. Because the LLC is shared among all cores of processor, it is more exploited in the case of side-channel attacks between two VMs. The main idea of side-channel attacks rests on the eviction of cache lines from cache and measuring fetching time of memory lines from RAM to know which cache lines are re-accessed by the victim during an operation, to obtain the victim's cache access pattern. Furthermore, if a memory line was flushed by the cache, it takes more CPU cycles to fetch the line from the main memory when it is reaccessed. Otherwise, the line is already in the cache, thus requiring fewer CPU cycles. This timing difference is exploited to profile cache access patterns of the victim.Generally, any cache-based side channel attack consists of three principal steps: (1) the attacker evicts cache lines of victim VM from processor's cache by e.g., filling cache sets (2) the attacker then waits for a given period of time (several CPU cycles) while the victim is doing some operations (3) finally, the attacker re-accesses the same cache lines which are evicted from caches, to know which ones are used by the victim during the execution of the victim's operations e.g., encryption.There are three classes of the attacks: time-driven, trace-driven, and access-driven. The main idea behind time-driven attacks is to measure the execution time of e.g., an encryption operation, and derive a secret key from the gathered samples by finding any correlation between measured time and the operation. In tracedriven attacks[START_REF] Acıic | Trace-driven cache attacks on aes (short paper)[END_REF],[START_REF] Gallais | Improved tracedriven cache-collision attacks against embedded aes implementations[END_REF], the attacker inspects cache activities (i.e., memory lines which are accessed) of the victim during its execution in order to obtain a sequence of cache hits and cache misses. For instance, monitoring which memory accesses to a lookup table lead to cache hits, allows finding indices of tables entries. In accessdriven attacks[START_REF] Yarom | Flush+Reload: A High Resolution, Low Noise, L3 Cache Side-Channel Attack[END_REF],[START_REF] Gruss | Flush+ Flush: A Fast and Stealthy Cache Attack[END_REF], the attacker tries to find any relation between e.g., an encryption process and accessed cache lines, to exploit the pattern of cache accesses of the victim. Technically, we may also distinguish different techniques to perform a cache-based side-channel attack: Prime+Probe, Flush+Reload, Flush+Flush, and Evict+Time. Prime+Probe is the first and common technique for profiling the victim VM through a shared cache. The attacker needs to observe which cache lines are accessed by the victim during the execution of sen-sitive operations using timing information (provided by instructions such as rdtsc). The Flush+Reload technique has more resolution than other attack techniques because of leveraging memory deduplication feature and inclusive caches.IV. DESIGN AND IMPLEMENTATIONThe main idea behind our detection approach is to analyze periodically the behavior of running VMs, to identify malicious activities which may be detected as a side-channel attack. We need to have several different fine-grained (provided by the hardware) information gathered along the execution of VMs. To date, there are two hardware sources providing high resolution cache-related information on running VMs that might be utilized for analysis purposes: Intel CMT and HPCs.A. Threat ModelWe assume a IaaS cloud and that the underlying CPU is based on x86 architecture equipped with Intel CMT. We also assume that victim and attacker VMs are pinned to different cores of processor. It means only the LLC is shared between two VMs. Thus private resources of a core such as L1 cache and the unified L2 cache are not shared between two VMs. The detection module aims to detect side-channel attacks conducted between two VMs through the LLC. We further assume that the attacker has full control on his VM and is capable of exploiting the LLC through certain lowlevel instructions such as rdtsc and clflush which are accessible to unprivileged users in x86 architecture. Design and implementation objectives for our detection are as follows: (1) it should detect side-channel attacks between two VMs through the LLC (2) it should not impose modifications to the hypervisor to be generic and compatible with other hypervisors (3) it should induce small performance overhead. B. Components of the Detection Module In our design, we take advantage of following techniques/technologies to detect the attacks: a) Intel Cache Monitoring Technology (CMT): Intel has introduced two features in processors to improve cache utilization: Cache Allocation Technology (CAT) and Cache Monitoring Technology (CMT). CAT is basically intended to provide Quality of Service (QoS) to running workloads (i.e., VMs, applications) in the allocation of LLC. CMT aims for monitoring the use of shared resources. Recent processors have several cores allowing to run simultaneously diverse workloads on CPU cores. This capability may potentially cause run-time resource contention on shared processor resources such as the LLC. Consequently, such resource contention may result in reduced performance of the overall system. This issue gets more importance in real-time and virtualized systems, where performance is critical. For instance, in a virtualized environment such as the cloud, CMT allows monitoring LLC occupancy of VMs running on the same physical host in a data center, finding aggressive VMs and then reacting to such events by applying resource usage limitation through CAT. Regarding cache-based side-channel attacks, as the attacker VM evicts several cache lines many times Name Event Description LLC-misses Last-level cache misses LLC-references Last-level cache references LLC-r-accesses Last-level cache read accesses LLC-w-accesses Last-level cache write accesses L1-dcache-misses L1-data cache misses L1-icache-misses L1-instruction cache misses iTLB-r-accesses Instruction TLB read accesses iTLB-cache-misses Instruction TLB read misses Table I: Specific hardware performance events related to cache from the cache, this aggressive behavior can be detected by CMT. Hence cache occupancy is provided at the byte-level granularity. Therefore, we can use the cache occupancy of a VM as an effective information in the detection of cache-based side-channel attacks through the LLC. In our detection module, we thus leverage CMT as a means to provide useful information to detect these attacks targeting the LLC. To date, our detection approach is the first to leverage Intel CMT to detect side-channel attacks. b) Hardware Performance Counters (HPCs): These are special platform hardware registers used to store statistics about various CPU events such as clock cycles and context-switches. Those events are widely used to profile a program's behavior to analyze and optimize it. Collected performance data may also be analyzed to detect any situation of performance degradation. For instance, in the Intel micro-architecture, the events are provided by Processor Monitoring Units (PMU) and are accessible through the perf_events subsystem provided by the Linux kernel. For system security, HPCS are widely used in the detection of different attacks such as Rowhammer [12] and cachebased side-channels [4]. Our detection module takes advantage of HPCs to detect malicious VMs in a virtualized environment. Table

Fig. 1 Figure 1 :

 11 Fig. 1 gives an overview of the architecture of the detection module. Our detection prototype is composed of three threads: The main thread is the core of module and probes periodically the system to collect statistics information (i.e., LLC-occupancy, LLC-misses, etc.) of all running VMs. A second thread scans the host machine to provide a live list of running VMs. A detection thread applies Gaussian anomaly detection on collected information to identify any malicious behavior. The detection module is implemented as a user space program written

Figure 3 : 5 ( 5 (Figure 6 :

 3556 Figure 3: LLC cache misses vs. system functions for attacker VM

i.e., when a compute-intensive workload is present. In Fig. 5.c and Fig. 5.d, we also notice that there is a clear difference between the iTLB-cache-misses rate ( iTLB-cache-misses ITLB-r-accesses ) of the compute-intensive VM and the attacker VM. Therefore, this can be used as an important feature for distinguishing between the attacker VM and compute-intensive VM. We also observe that a malicious VM has a lower iTLB-cache-misses rate (e.g., 1.2%) than a benign VM (e.g., 30%). Consequently, by using this feature, we can distinguish compute-intensive workload and malicious VMs, that results in a false positive reduction. We also carried out other experimentation to assess the efficiency of Intel CMT in detection accuracy on two different scenarios; when Intel CMT is enabled, and when it is not. We obtained 0.67 as F 1 -score when Intel CMT was enabled than 0.5 without Intel CMT. It means, we effectively obtained more precision in our detection approach through leveraging Intel CMT (Fig. 4).

2) Performance Overhead: The detection module imposes about 2% performance overhead to the hypervisor, which is negligible. However, we measured this value for 6 running VMs on the platform. This value may increase when extending the number of running VMs or during a long period of probing to collect perf information.

VI. CONCLUSION

In this paper, we presented a new approach of cross-VM side-channel attack detection leveraging Intel Cache