Covert channels have been an effective means for leaking confidential information across security domains and numerous studies are available on typical covert channels attacks and defenses. Existing covert channel threat restriction solutions are based on the threat estimation criteria of covert channels such as capacity, accuracy, and short messages which are effective in evaluating the information transmission ability of a covert (storage) channel. However, these criteria cannot comprehensively reflect the key factors in the communication process such as shared resources and synchronization and therefore are unable to evaluate covertness and complexity of increasingly upgraded covert storage channels. As a solution, the anti-detection criterion was introduced to eliminate these limitations of cover channels. Though effective, most threat restriction techniques inevitably incur high performance overhead and hence become impractical. In this work, we avoid such overheads and present a restriction algorithm based on the anti-detection criterion to restrict threats that are associated with covert storage channels in virtual machines while maintaining the resource efficiency of the systems. Experimental evaluation shows that our proposed solution is able to counter covert storage channel attacks in an effective manner. Compared with Pump, a well-known traditional restriction algorithm used in practical systems, our solution significantly reduces the system overhead.

中文翻译：

---

通过反检测标准缓解虚拟机中隐蔽存储通道攻击的有效方法

隐蔽通道一直是跨安全域泄露机密信息的有效手段，并且有大量关于典型隐蔽通道攻击和防御的研究。现有的隐蔽信道威胁限制解决方案是基于隐蔽信道的容量、准确性、短消息等威胁估计标准，有效评估隐蔽（存储）信道的信息传输能力。然而，这些标准不能全面反映通信过程中的共享资源和同步等关键因素，因此无法评估日益升级的隐蔽存储通道的隐蔽性和复杂性。作为一种解决方案，引入了反检测标准来消除覆盖通道的这些限制。虽然有效，大多数威胁限制技术不可避免地会导致高性能开销，因此变得不切实际。在这项工作中，我们避免了这种开销，并提出了一种基于反检测标准的限制算法，以限制与虚拟机中隐蔽存储通道相关的威胁，同时保持系统的资源效率。实验评估表明，我们提出的解决方案能够以有效的方式对抗隐蔽存储通道攻击。与实际系统中使用的众所周知的传统约束算法Pump相比，我们的解决方案显着降低了系统开销。我们避免了这种开销，并提出了一种基于反检测标准的限制算法，以限制与虚拟机中隐蔽存储通道相关的威胁，同时保持系统的资源效率。实验评估表明，我们提出的解决方案能够以有效的方式对抗隐蔽存储通道攻击。与实际系统中使用的众所周知的传统约束算法Pump相比，我们的解决方案显着降低了系统开销。我们避免了这种开销，并提出了一种基于反检测标准的限制算法，以限制与虚拟机中隐蔽存储通道相关的威胁，同时保持系统的资源效率。实验评估表明，我们提出的解决方案能够以有效的方式对抗隐蔽存储通道攻击。与实际系统中使用的众所周知的传统约束算法Pump相比，我们的解决方案显着降低了系统开销。