Effects of Memory Randomization,          Sanitization and Page Cache on              Memory Deduplication                ...
Background 1/2• Infrastructure as a Service(IaaS) type cloud computing  offers OS hosting service and runs many virtual ma...
Background 2/2• Some attacks are appeared on IaaS, and users want to  increase security of Guest OS.   – For example, Cros...
Contents1) Background2) Memory deduplication3) OS security functions  – Address Space Layout randomization, Memory Sanitiz...
Memory Deduplication 1/2• Memory deduplication is a technique to share same  contents page.   – Mainly used for virtual ma...
Memory Deduplication 2/2• Content-aware deduplication  – Check contents when data is loaded from disk to memory.     • Tra...
KSM: Kernel Samepage Merging• KSM has 3 states for pages.   – Volatile : contents change frequently (not to be candidate) ...
Contents1) Background2) Memory deduplication3) OS security functions  – Address Space Layout randomization, Memory Sanitiz...
OS Security functions• Modern OSes have security functions that modify  memory contents dynamically.   1. Address Space La...
Address Space Layout Randomization(ASLR)• Normal binary has fixed Memory layout, and has vulnerability for  overflow attac...
Memory sanitization• Technique for zero-clearing pages after use.   – Sensitive data remain for long periods after use, an...
Page Cache flushing• Page Cache flushing reduces possibility of information leak.• Page Cache reduces I/O overhead when pa...
Contents1) Background2) Memory deduplication3) OS security functions  – Address Space Layout randomization, Memory Sanitiz...
Experiments• Measure the effects of 3 security functions (ALSR, memory  sanitization, DropCache: page cache flushing) on m...
Effects of Position Independent Executable (PIE)• Gentoo Linux has 1,469 ELF binary files in /bin, /sbin,  /usr/bin, and /...
With and without ASLR, DropCache and              Sanitization on 4VMs  Security function                                 ...
With and without ASLR, DropCache and                 Sanitization on 4VMs                                                 ...
Virtual and Physical memory consumption                                       Sanitization use        MB        2500      ...
DropCache: Page Flushing• DropCache was issued every second. It takes 10 - 20  microseconds (1% or 2%), thus it does not a...
Memory Usage in KSM: PIE Gentoo at a stable         state after booting 1, 2, and 4 VMs           MB            250       ...
Trace of Memory usage on KSM with 4VMs• Sanitization sets memory contents to zero on all memory pages at boot  time. KSM c...
Contents1) Background2) Memory deduplication3) OS security functions  – Address Space Layout randomization, Memory Sanitiz...
Discussions• Co-Design of GuestOS and VMM   – Some VMMs offers zero-cleared pseudo memory to a VM. If     memory sanitizat...
Related Works• Memory deduplication has potential to change structure of OS.  – Memory deduplication is used to increase s...
Conclusions• Our paper measures the affects of security functions (ASLR,  sanitization, page cache flushing) on real memor...
Upcoming SlideShare
Loading in …5
×

EuroSec2012 "Effects of Memory Randomization, Sanitization and Page Cache on Memory Deduplication" by K.Suzaki

1,276 views
1,203 views

Published on

This is Slide for EuroSec2012 "Effects of Memory Randomization, Sanitization and Page Cache on Memory Deduplication" by K.Suzaki.

Published in: Technology, Education
0 Comments
0 Likes
Statistics
Notes
  • Be the first to comment

  • Be the first to like this

No Downloads
Views
Total views
1,276
On SlideShare
0
From Embeds
0
Number of Embeds
2
Actions
Shares
0
Downloads
23
Comments
0
Likes
0
Embeds 0
No embeds

No notes for slide

EuroSec2012 "Effects of Memory Randomization, Sanitization and Page Cache on Memory Deduplication" by K.Suzaki

  1. 1. Effects of Memory Randomization, Sanitization and Page Cache on Memory Deduplication Kuniyasu Suzaki, Kengo Iijima, Suzaki Iijima Toshiki Yagi, Cyrille Artho Research Institute for Secure SystemsEuroSec 2012 at Bern, April 10
  2. 2. Background 1/2• Infrastructure as a Service(IaaS) type cloud computing offers OS hosting service and runs many virtual machines. – Examples: Amazon EC2, Rackspace, ... – Physical resources are very important. Many techniques are developed to save resources. resources• We concentrate on memory. • Memory Deduplication is utilized to share same contents and reduces consumption of physical memory.• Venders want to use this function, but …
  3. 3. Background 2/2• Some attacks are appeared on IaaS, and users want to increase security of Guest OS. – For example, Cross VM Side channel attack [CSS2009]• Guest OSes have some choices of security function. – Some of them change the behavior of memory and will work to i increase or decrease performance of memory deduplication. d f f d d li i• Our paper measures the affects of security functions on real memory deduplication (KSM with KVM).
  4. 4. Contents1) Background2) Memory deduplication3) OS security functions – Address Space Layout randomization, Memory Sanitization, randomization Sanitization Page Cache flashing4) Experimental results – On Linux’s KSM (Kernel Samepage Merging) with KVM virtual machine monitor5) Discussion and Conclusion
  5. 5. Memory Deduplication 1/2• Memory deduplication is a technique to share same contents page. – Mainly used for virtual machines. – Very effective when same guest OS runs on many virtual machines.• Many virtual machine monitors include deduplication with different implementations. Guest Pseudo Memory VM1 VM2 VM(n) Real Physical Memory
  6. 6. Memory Deduplication 2/2• Content-aware deduplication – Check contents when data is loaded from disk to memory. • Transparent Page Sharing on Disco [OSDI97] • Satori on Xen[USENIX09]• Periodical memory-scan deduplication – Scan memory pages and merge when pages are same. It can treat dynamically created contents pages. • Content-Based Page Sharing on VMWare ESX [SOSP02] • Differential Engine on Xen[OSDI08] • KSM (Kernel Samepage Merging) [LinuxSymp09] – General-purpose memory deduplication for Linux. – Used mainly for KVM.• Our paper uses KSM with KVM virtual machine.
  7. 7. KSM: Kernel Samepage Merging• KSM has 3 states for pages. – Volatile : contents change frequently (not to be candidate) – Unshared: candidate pages for deduplication (unique at present) – Shared: deduplicated pages with same contents.• Pages are scanned (default: 20msec) – All pages are not scanned at a trial. t d t ti l – The maximum is 25% of the available memory. – The time to be deduplicated depends on the situation.
  8. 8. Contents1) Background2) Memory deduplication3) OS security functions – Address Space Layout randomization, Memory Sanitization, randomization Sanitization Page Cache flashing4) Experimental results – On Linux’s KSM (Kernel Samepage Merging) with KVM virtual machine monitor5) Discussion and Conclusion
  9. 9. OS Security functions• Modern OSes have security functions that modify memory contents dynamically. 1. Address Space Layout Randomization (ASLR) with Position Independent Executable (PIE) 2. Memory Sanitization 3. Page Cache flashing
  10. 10. Address Space Layout Randomization(ASLR)• Normal binary has fixed Memory layout, and has vulnerability for overflow attack.• ASLR gives randomized offset (aligned page) to code, library, and stack. • Early ASLR for Linux is implemented on PaX and Exec Shield Linux. • Linux 2.6.12 (June 2005), Windows VISTA.• Binaries have to be Position Independent Executable (PIE). – GCC has options to compile a code for PIE-ELF binary. (“-fPIE” for compiler p p y ( p and “–pie” for linker) • Disadvantage: PIE binaries become fat, because the all addressing are relocatable.• ASLR and PIE binaries will affect memory deduplication. Normal ELF PIE-ELF on ASLR Stack 0x???????? Stack 0xBFFFF000 Library 0x???????? Library 0x40000000 Position Independent PIE code 0x???????? The address is Code 0x08048000 changed for each process on ASLR
  11. 11. Memory sanitization• Technique for zero-clearing pages after use. – Sensitive data remain for long periods after use, and Chow proposed Secure deallocation [USENIX Security 04, 05] . It prevents information leak.• Linux has unconditional page sanitization patch. – Increased zero-cleared pages will be deduplicated. As a result, it will reduces consumption of physical memory. memory – Disadvantage: • Linux’s sanitization requires zero-clearing all physical pages at boot time. • Do not treat page cache, because cashed pages are not released from a kernel. Physical Memory 0xXXXX0000 000000 0000000 00000000 Zero-cleared 0x00000000
  12. 12. Page Cache flushing• Page Cache flushing reduces possibility of information leak.• Page Cache reduces I/O overhead when pages are accessed repeatedly. However, the page cache may include sensitive data.• Linux kernel has DropCache for page cache flushing. – DropCache released all cached pages from the kernel. • “cron” is used to flush page cache at certain intervals (1 sec). – Th fl h d memory region i reused f other processes. A a result, it will The flushed i is d for th As lt ill reduce consumption of physical memory. – DropCache does not zero-clear the released pages. We need to enable sanitization to zero-clear the pages. – Disadvantage: • Re-loaded data from disk when the same contents are accessed again.
  13. 13. Contents1) Background2) Memory deduplication3) OS security functions – Address Space Layout randomization, Memory Sanitization, randomization Sanitization Page Cache flashing4) Experimental results – On Linux’s KSM (Kernel Samepage Merging) with KVM virtual machine monitor5) Discussion and Conclusion
  14. 14. Experiments• Measure the effects of 3 security functions (ALSR, memory sanitization, DropCache: page cache flushing) on memory deduplication (KSM with KVM).• Test environment – Intel Core2Quad (Q9650) 3.0GHz processor – Host OS: Ubuntu 9.10 (kernel: vanilla-2.6.32.1) with memory deduplication KSM and virtual machine monitor KVM – 2 type of Guest OSes • Normal Gentoo Linux (1.12.13, kernel 2.6.31) on a 32GB virtual disk (31GB ext3, 1GB swap) • Gentoo Linux which is built as PIE binaries – It utilize ALSR
  15. 15. Effects of Position Independent Executable (PIE)• Gentoo Linux has 1,469 ELF binary files in /bin, /sbin, /usr/bin, and /usr/sbin. – On Normal Gentoo the total is 88.4MB – On PIE Gentoo the total is 94.6MB (7% more). • The biggest change: “pampop9” 5 396B -> 9,440B (75% more) pampop9 5,396B > 9 440B more). • The smallest change: “wall” from 9,624B to 9,392B (2% less).• From after PIE Gentoo is mainly used.
  16. 16. With and without ASLR, DropCache and Sanitization on 4VMs Security function Stable State ①Peak Mem ⑤Guest OS (MB) ③ Sharing ④ Unshared+ Boot TimeASLR DropCache Sanitize Virtual/Physical ② Physical Mem (MB) (MB (%)) Volatile (sec) (MB (%)) ○ 574/458 234.9 106.4(45.3) 128.5(54.7) 62 ○ ○ 431/332 206.9 70.7(34.1) 136.3(65.9) 83 ○ ○ 2063/1661 204.6 82.1(40.1) 122.5(59.9) 61 ○ ○ ○ 2063/1616 186.5 39.4(21.1) 147.1(78.9) 83 574/455 199.0 120.1(60.4) 78.9(39.6) 62 ○ 429/316 169.5 83.1(49.0) 86.5(51.0) 82 ○ 2063/1661 171.2 94.0(54.9) 77.2(45.1) 62 ○ ○ 2063/1161 129.9 50.4(38.8) 79.5(61.2) 85
  17. 17. With and without ASLR, DropCache and Sanitization on 4VMs DropCache delayed Security function Stable State ①Peak Mem the boot time. ⑤Guest OS (MB) ③ Sharing ④ Unshared+ Boot Time ASLR DropCache Sanitize Virtual/Physical ② Physical Mem (MB) (MB (%)) Volatile (sec) (MB (%)) ○ 574/458 +18% 234.9 106.4(45.3) 128.5(54.7) 62 ○ ○ 431/332 206.9 70.7(34.1) 136.3(65.9) 83 -12% ○ ○ 2063/1661 204.6 82.1(40.1) 122.5(59.9) 61 -13% 13% ○ ○ ○ 2063/1616 +43% -21% 186.5 39.4(21.1) 147.1(78.9) 83 Decrease Increase 574/455 199.0 120.1(60.4) 78.9(39.6) 62 ○ 429/316 169.5 83.1(49.0) 86.5(51.0) 82 -15% ○ 2063/1661 171.2 94.0(54.9) 77.2(45.1) 62 -14% ○ ○ 2063/1161 129.9 50.4(38.8) 79.5(61.2) 85 -35%Sanitization uses all virtual ASLR decreases deduplication andmemory, but consumption increases unique pages. It means ASLR increases physical memory consumptionof physical memory is ASLR reduces opportunities for Others (DropCache, Sanitization, and Both)reduced by deduplication. memory deduplication. decrease.
  18. 18. Virtual and Physical memory consumption Sanitization use MB 2500 all memory Virtual Max 1VM, 2VMs, 4VMs Physical Max 2000 1500 1000 Smallest Smallest 500 0• Sanitization uses all virtual memory. KSM depress the consumption of physical memory but it is still large.• DropCache, (2) and (6), shows the smallest consumptions, because the flushed pages are reused. – They shows enabling DropCahe is the best from the view of memory, but DropCache affects the time performance of GuestOS.
  19. 19. DropCache: Page Flushing• DropCache was issued every second. It takes 10 - 20 microseconds (1% or 2%), thus it does not affect performance severely.• However, the boot time with DropCache increases by about 20 seconds (30% more). b d )• The other boot procedures read 65MB of data from disk. DropCache increases this to 99MB (52% more). PIE Gentoo Disk Read (MB) (seconds) Normal 65 No DropCache 61―62 DropCache 99 DropCache 82―85 Sanitize 65
  20. 20. Memory Usage in KSM: PIE Gentoo at a stable state after booting 1, 2, and 4 VMs MB 250 Shared 1VM,2VMs,4VMs Unshare 200 Volatile 150 100 50 0• Total memory(volatile+unshared+sharing) with ASLR are larger than without ASLR.• Volatile and Sharing pages are almost the same. ASLR increases the number of unshared pages. It means that ASLR increases pages with different contents.• However, it is strange because ASLR dons not change the contests. The reason is not well analyzed.
  21. 21. Trace of Memory usage on KSM with 4VMs• Sanitization sets memory contents to zero on all memory pages at boot time. KSM could not catch up.• However, the performance of Guest OS is not effected, because KSM limits the number of pages at a trial, and postpone deduplication. – After booting, KSM deduplicates memory pages. MB 2000 MB 2000 sharing 1500 shared 1500 sharing unshared shared 1000 volatile 1000 unshared volatile 500 500 0 sec 0 0 100 200 300 sec 0 100 200 300 Without Sanitization(PIE Gentoo on ASLR) With Sanitization
  22. 22. Contents1) Background2) Memory deduplication3) OS security functions – Address Space Layout randomization, Memory Sanitization, randomization Sanitization Page Cache flashing4) Experimental results – On Linux’s KSM (Kernel Samepage Merging) with KVM virtual machine monitor5) Discussion and Conclusion
  23. 23. Discussions• Co-Design of GuestOS and VMM – Some VMMs offers zero-cleared pseudo memory to a VM. If memory sanitization recognizes it, the zero-clearing process may be removed. – If VMM control page flushing (balance page cache and I/O), it can achieve global optimization among many VMs. hi l b l ti i ti VM • It will be a counter part of ballon memory of VMM.• Consider Scalability on IaaS – DropCache reduces the consumption of memory, but it also reduce time performance. If a server (IaaS) hosts OSes which don’t care time performance, DropCache is effective.
  24. 24. Related Works• Memory deduplication has potential to change structure of OS. – Memory deduplication is used to increase security • SLINKY[USENIX ATC 2005] encourages static-linking, because memory deduplication reduces the increase memory. • Instead of static-linking, Self-contained ELF binaries (binaries which include shared libraries) is used for generalization [HotSec 2010] – Attack on memory deduplication • Memory disclosure attack for Copy-On-Write [EuroSec 2011] • OS Fingerprint [IPCCC2011]• Memory deduplication is improved. • KSM++ [RESoLVE 2012] • HICAMP [APSOLS 2012] Hardware memory deduplication. The size is very small (16-256 Byte).
  25. 25. Conclusions• Our paper measures the affects of security functions (ASLR, sanitization, page cache flushing) on real memory deduplication (KSM with KVM). – ASLR increases consumption of physical memory, which is more than anticipated. – Memory sanitization has to initialize all memory, but the CPU overhead for GuestOS is low, because memory merging is postponed at heavy load. low load – Page cache flushing (DropCache) reduces consumption of physical memory by reusing released pages. However, the overhead is large, which is caused by re-loading data from a disk.• We should consider co-design of VMM and security function of guestOS and increase the scalability of IaaS.

×