Ohms Law in Data Centers: A Voltage Side Channel for Timing Power - - PowerPoint PPT Presentation

▶
ohm s law in data centers
SMART_READER_LITE
LIVE PREVIEW

Ohms Law in Data Centers: A Voltage Side Channel for Timing Power - - PowerPoint PPT Presentation

Apr 24, 2023 387 likes •1.15k views

Ohms Law in Data Centers: A Voltage Side Channel for Timing Power Attacks Mohammad A. Islam and Shaolei Ren UC Riverside Acknowledgement: This work was supported in part by the U.S. NSF under grants CNS-1551661 and ECCS-1610471. Cloud data

slide-1
SLIDE 1

Ohm’s Law in Data Centers:

A Voltage Side Channel for Timing Power Attacks

Mohammad A. Islam and Shaolei Ren UC Riverside

Acknowledgement: This work was supported in part by the U.S. NSF under grants CNS-1551661 and ECCS-1610471.

slide-2
SLIDE 2

Cloud data centers

2

slide-3
SLIDE 3

2

User/Tenant = Virtual machines

This talk is not about cloud data centers

slide-4
SLIDE 4

Multi-tenant data centers (a.k.a. “colo”)

Managed by Operator Non-IT infrastructure Utility (Primary) Generator UPS ATS P D U P D U Computer Servers

3

slide-5
SLIDE 5

Multi-tenant data centers (a.k.a. “colo”)

A shared data center facility that houses multiple tenants, each managing its own servers…

Managed by Tenants Managed by Operator Non-IT infrastructure Utility (Primary) Generator UPS ATS P D U P D U Computer Servers

3

slide-6
SLIDE 6

Apple houses 25% of its servers in multi-tenant data centers…

Multi-tenant data centers are everywhere…

4

slide-7
SLIDE 7

Google, Amazon, MS, Fb… :7.8% Enterprise: 53% Multi-tenant: 37%

Percentage of electricity usage by data center type (source: NRDC 2015)

Multi-tenant data centers are everywhere…

4

slide-8
SLIDE 8

Data center security

  • Mission-critical infrastructure
  • Backbone of digital economy
  • 50% growth by 2020
  • IoT and edge computing
  • ……

Securing the cyberspace is well studied

DDoS attack, network intrusion, privacy protection, etc. [Mirkovic Sigcomm’04][Zhang CCS’12][Moon CCS’15][Dong CCS’17]…

5

slide-9
SLIDE 9

Data center security

Are the physical infrastructures secure?

5

slide-10
SLIDE 10

Multimillion-dollar investment

UPS PDU ATS Utility Generator Servers

How to attack physical infrastructures?

6

slide-11
SLIDE 11

Hacking control systems Human intrusion

Power

Overload using server power Multimillion-dollar investment

UPS PDU ATS Utility Generator Servers

How to attack physical infrastructures?

6

slide-12
SLIDE 12

Hacking control systems Human intrusion

Power

Overload using server power

Our focus

Multimillion-dollar investment

UPS PDU ATS Utility Generator Servers

How to attack physical infrastructures?

6

slide-13
SLIDE 13

Generator UPS ATS P D U P D U

Threat model

7

slide-14
SLIDE 14

Generator UPS ATS P D U P D U

Threat model

7

slide-15
SLIDE 15

Generator UPS ATS P D U P D U Malicious Tenant

Malicious load

Threat model

7

Power attack: Well-timed power injection to overload the shared data center capacity, subject to all applicable constraints set by the operator

slide-16
SLIDE 16

Threat model

7

Power attacks make outages more likely (~280x more likely for a Tier-IV data center )

slide-17
SLIDE 17

Cost analysis of power attacks

15.6 8.7 3.5 10 20 Tier-II Tier-III Tier-IV

Million $/MW/year

Estimated impact of overloads (5% of the time, size: 1MW-10,00sqft)

Million dollar impact!

Increased redundancy

8

slide-18
SLIDE 18

How to precisely time power attacks?

  • Random attacks are unlikely to be successful, while constant

full power is prohibited

9

slide-19
SLIDE 19

How to precisely time power attacks?

  • Random attacks are unlikely to be successful, while constant

full power is prohibited

  • Coarse timing (e.g., based on “peak” hours) is ineffective

9

slide-20
SLIDE 20

How to precisely time power attacks?

  • Random attacks are unlikely to be successful, while constant

full power is prohibited

  • Coarse timing (e.g., based on “peak” hours) is ineffective

How to estimate the power load without power meters?

9

slide-21
SLIDE 21

“Wireless” side channels

References

  • M. A. Islam, S. Ren, and A. Wierman, “Exploiting a Thermal Side Channel for Power Attacks in Multi-Tenant Data Centers,” ACM Conference on

Computer and Communications Security (CCS), 2017.

  • M. A. Islam, L. Yang, K. Ranganath, and S. Ren, “Why Some Like It Loud: Timing Power Attacks in Multi-tenant Data Centers Using an Acoustic Side

Channel,” ACM International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS), 2018.

Thermal: Higher power produces more heat

  • Requires heat recirculation model
  • Slow responses
  • Only applicable to raised-floor designs
slide-22
SLIDE 22

“Wireless” side channels

References

  • M. A. Islam, S. Ren, and A. Wierman, “Exploiting a Thermal Side Channel for Power Attacks in Multi-Tenant Data Centers,” ACM Conference on

Computer and Communications Security (CCS), 2017.

  • M. A. Islam, L. Yang, K. Ranganath, and S. Ren, “Why Some Like It Loud: Timing Power Attacks in Multi-tenant Data Centers Using an Acoustic Side

Channel,” ACM International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS), 2018.

Thermal: Higher power produces more heat

  • Requires heat recirculation model
  • Slow responses
  • Only applicable to raised-floor designs

Acoustic: More heat requires more cold air

  • Inaccurate timing due to near-far effects
  • Limited distance
  • Easy to degrade by injecting additional noise
slide-23
SLIDE 23

A voltage side channel due to Ohm’s Law

11

slide-24
SLIDE 24

Ohm’s Law

𝐒 𝐉 𝐖𝟐 𝐖𝟑 𝐖 = 𝐉 ⋅ 𝑺

12

slide-25
SLIDE 25

Ohm’s Law

𝐒 𝐉 𝐖𝟐 𝐖𝟑 𝐖𝟐 − 𝐖𝟑 = 𝐉 ⋅ 𝑺

12

slide-26
SLIDE 26

Ohm’s Law

𝐒 𝐉 𝐖𝟐 𝐖𝟑 The voltage at the other end depends on the current 𝐖𝟑 = 𝐖𝟐 − 𝐉 ⋅ 𝑺

12

slide-27
SLIDE 27

UPS PDU 𝑺 𝑺𝒃 Attacker Server

Ohm’s Law in data centers

13

slide-28
SLIDE 28

UPS PDU 𝑺 𝑺𝒃 Attacker Server

Ohm’s Law in data centers

Line resistance

13

slide-29
SLIDE 29

UPS PDU 𝑱𝒃 𝑺 𝑺𝒃 Attacker Server 𝑱 = ∑𝑱𝒐

Ohm’s Law in data centers

𝑱𝟐 𝑱𝟑

13

slide-30
SLIDE 30

Attacker’s voltage 𝑾𝒃 = 𝑾𝑸𝑬𝑽 − 𝑱𝒃𝑺𝒃 UPS PDU 𝑱𝒃 𝑺 𝑺𝒃 Attacker Server 𝑱 = ∑𝑱𝒐

Ohm’s Law in data centers

𝑱𝟐 𝑱𝟑

13

slide-31
SLIDE 31

Own impact Power load is included in 𝑾𝒃 Attacker’s voltage 𝑾𝒃 = 𝑾𝑸𝑬𝑽 − 𝑱𝒃𝑺𝒃 = 𝑾𝑽𝑸𝑻 − ∑𝑱𝒐𝑺 − 𝑱𝒃𝑺𝒃 UPS PDU 𝑱𝒃 𝑺 𝑺𝒃 Attacker Server 𝑱 = ∑𝑱𝒐

Ohm’s Law in data centers

𝑱𝟐 𝑱𝟑

13

slide-32
SLIDE 32

Attacker’s voltage 𝑾𝒃 = 𝑾𝑽𝑸𝑻 − ∑𝑱𝒐𝑺 − 𝑱𝒃𝑺𝒃

A voltage side channel

14

slide-33
SLIDE 33

Attacker’s voltage 𝑾𝒃 = 𝑾𝑽𝑸𝑻 − ∑𝑱𝒐𝑺 − 𝑱𝒃𝑺𝒃 𝚬𝐖 based attack: Low voltage  High current/load Attack opportunity?

A voltage side channel

14

slide-34
SLIDE 34

Attacker’s voltage 𝑾𝒃 = 𝑾𝑽𝑸𝑻 − ∑𝑱𝒐𝑺 − 𝑱𝒃𝑺𝒃 𝚬𝐖 based attack: Low voltage  High current/load Attack opportunity? Large random variation from power grid

A voltage side channel

14

slide-35
SLIDE 35

Attacker’s voltage 𝑾𝒃 = 𝑾𝑽𝑸𝑻 − ∑𝑱𝒐𝑺 − 𝑱𝒃𝑺𝒃 𝚬𝐖 based attack: Low voltage  High current/load Attack opportunity? Large random variation from power grid

  • Grid variation = ~3V
  • Voltage drop variation = ~10mV

A voltage side channel

14

slide-36
SLIDE 36

A voltage side channel

How to extract power load information from voltage signals?

14

slide-37
SLIDE 37

Power Factor Correction (PFC)

A closer look at server’s power supply

15

slide-38
SLIDE 38

Power Factor Correction (PFC)

A closer look at server’s power supply

Without PFC Current draw is bursty

15

slide-39
SLIDE 39

Power Factor Correction (PFC)

A closer look at server’s power supply

Without PFC With PFC Current draw is bursty Current follows a sinewave with high-frequency ripples

15

slide-40
SLIDE 40

The ripples come from the PFC control

Power Factor Correction (PFC) PWM Control Output voltage sample Input voltage sample Rectifier Inductor Diode MOSFET

16

slide-41
SLIDE 41

The ripples come from the PFC control

Power Factor Correction (PFC) PWM Control Output voltage sample Input voltage sample Rectifier Inductor Diode MOSFET Reference Current

16

slide-42
SLIDE 42

The ripples come from the PFC control

Power Factor Correction (PFC) PWM Control Output voltage sample Input voltage sample Rectifier Inductor Diode MOSFET Actual Current Reference Current

16

slide-43
SLIDE 43

The ripples come from the PFC control

Power Factor Correction (PFC) PWM Control Output voltage sample Input voltage sample Rectifier Inductor Diode MOSFET 𝑼𝒑𝒐 𝑼𝒑𝒈𝒈 𝑼 𝑼𝒑𝒐 𝑼𝒑𝒈𝒈 𝑼 Actual Current Reference Current

16

slide-44
SLIDE 44

The ripples come from the PFC control

Power Factor Correction (PFC) PWM Control Output voltage sample Input voltage sample Rectifier Inductor Diode MOSFET 𝑼𝒑𝒐 𝑼𝒑𝒈𝒈 𝑼 𝑼𝒑𝒐 𝑼𝒑𝒈𝒈 𝑼 Actual Current Reference Current

16

slide-45
SLIDE 45

Voltage measurement of a Dell server

17

slide-46
SLIDE 46

Voltage measurement of a Dell server

High-frequency ripples caused by PFC

17

slide-47
SLIDE 47

Voltage measurement of a Dell server

High-frequency ripples caused by PFC

Frequency analysis of the voltage signal

17

slide-48
SLIDE 48

Voltage measurement of a Dell server

High-frequency ripples caused by PFC

Frequency spike

(at PFC switching frequency)

Frequency analysis of the voltage signal

17

slide-49
SLIDE 49

Can we estimate the power load based on frequency spikes?

18

slide-50
SLIDE 50

Can we estimate the power load based on frequency spikes?

18

Our intuition says “yes”!

Given a higher current, the ripples need to rise up more during each cycle.

slide-51
SLIDE 51

Experiment

1 Oscilloscope

1 2 3 4 5 6

2 Network Switch 3 PowerEdge Servers 4 UPS 5 APC PDU 6 Voltage Measurement From Power Outlet

  • 13 Dell PowerEdge

servers

  • 3 different server

configurations

  • 3 different types of

power supply units

19

slide-52
SLIDE 52

Power supplies

1 2 3

2 495W, PFC Switching ~𝟕6kHz Model: F495E-S0 Manufacturer: Astec Intl. Ltd. 1 350W, PFC Switching ~𝟕𝟒kHz Model: D35E-S1 Manufacturer: Delta Electronics Inc. 3 495W, PFC Switching ~𝟖𝟏kHz Model: E495E-S1 Manufacturer: Flextronics Intl. Ltd.

20

slide-53
SLIDE 53

PSD vs. server power

21

slide-54
SLIDE 54

PSD vs. server power

Higher power creates taller frequency spikes

21

slide-55
SLIDE 55

PSD vs. server power

Higher power creates taller frequency spikes Aggregate PSD monotonically increases with server power

21

slide-56
SLIDE 56

PSD vs. server power

22

slide-57
SLIDE 57

PSD vs. server power

22

slide-58
SLIDE 58

PSD vs. server power

22

slide-59
SLIDE 59

PSD vs. server power

22

slide-60
SLIDE 60

Aggregate PSD is additive for multiple servers with similar PFC frequencies

PSD vs. server power

22

slide-61
SLIDE 61

Aggregate PSD is additive for multiple servers with similar PFC frequencies

PSD vs. server power

22

slide-62
SLIDE 62

Aggregate PSD is additive for multiple servers with similar PFC frequencies

PSD vs. server power

Frequency spikes are separated for different types

  • f power supply units

~63kHz ~66kHz ~70kHz

22

slide-63
SLIDE 63

Accuracy of the voltage side channel

Tenant #1 Tenant #2 Tenant #3

23

slide-64
SLIDE 64

Accuracy of the voltage side channel

Tenant #1 Tenant #2 Tenant #3

Estimating power loads with a high accuracy!

23

slide-65
SLIDE 65

24

Attack only when the estimated power load is sufficiently high

slide-66
SLIDE 66

Power attack

25

slide-67
SLIDE 67

Power attack

Tenants’ total power

25

slide-68
SLIDE 68

Power attack

Estimated power loads

25

slide-69
SLIDE 69

Power attack

Power attacks

25

slide-70
SLIDE 70

Timing accuracy

26

slide-71
SLIDE 71

Timing accuracy

>50% true positive rate and precision for ~10% attack

26

slide-72
SLIDE 72

Timing accuracy

>50% true positive rate and precision for ~10% attack

26

slide-73
SLIDE 73

Timing accuracy

>50% true positive rate and precision for ~10% attack

26

slide-74
SLIDE 74

Timing accuracy

>50% true positive rate and precision for ~10% attack

26

Also works with UPS and three-phase power systems

slide-75
SLIDE 75

Physical infrastructure sharing means everything but power security

Thanks!

UPS

P D U P D U References

  • M. A. Islam, S. Ren, and A. Wierman, “Exploiting a Thermal Side Channel for Power Attacks in Multi-Tenant Data Centers,” ACM Conference on

Computer and Communications Security (CCS), 2017.

  • M. A. Islam, L. Yang, K. Ranganath, and S. Ren, “Why Some Like It Loud: Timing Power Attacks in Multi-tenant Data Centers Using an Acoustic Side

Channel,” ACM International Conference on Measurement and Modeling of Computer Systems (SIGMETRICS), 2018.

  • M. A. Islam and S. Ren, “Ohm's Law in Data Centers: A Voltage Side Channel for Timing Power Attacks,” ACM Conference on Computer and

Communications Security (CCS), 2018.