Power attack defense

Key issues in data center security: An investigation of government audit reports

Maliciously-injected power load, a.k.a. power attack, has recently surfaced as a new egregious attack vector for dangerously compromising the data center availability. This paper focuses on the emerging threat of power attacks in a multi-tenant colocation data center, an important type of data center where multiple tenants house their own servers and share the power distribution system. Concretely, we discover a novel physical side channel --- a voltage side channel --- which leaks the benign tenants' power usage information at runtime and helps an attacker precisely time its power attacks. The key idea we exploit is that, due to the Ohm's Law, the high-frequency switching operation (40~100kHz) of the power factor correction circuit universally built in today's server power supply units creates voltage ripples in the data center power lines. Importantly, without overlapping the grid voltage in the frequency domain, the voltage ripple signals can be easily sensed by the attacker to track the benign tenants' runtime power usage and precisely time its power attacks. We evaluate the timing accuracy of the voltage side channel in a real data center prototype, demonstrating that the attacker can extract benign tenants' power pattern with a great accuracy (correlation coefficient = 0.90+) and utilize 64% of all the attack opportunities without launching attacks randomly or consecutively. Finally, we highlight a few possible defense strategies and extend our study to more complex three-phase power distribution systems used in large multi-tenant data centers.

With the rise in cyber-attacks on cloud environments like Brute Force, Malware or Distributed Denial of Service attacks, information security officers and data center administrators have a monumental task on hand. Organizations design data center and service delivery with the aim of catering to maximize device provisioning & availability, improve application performance, ensure better server virtualization and end up securing data centers using security solutions at internet edge protection level. These security solutions prove to be largely inadequate in times of a DDoS cyber-attack. In this paper, traditional data center design is reviewed and compared to the proposed three tier data center. The resilience to withstand against DDoS attacks is measured for Real User Monitoring parameters, compared for the two infrastructure designs and the data is validated using T-Test.

Data centers play a role, in today’s infrastructure supporting operations with vast networks of servers and storage systems. Safeguarding these data centers from cyber threats requires tools for managing SSL certificates and ongoing monitor- ing. This research assesses the effectiveness of OpenSSL, Venafi and Sensu in bolstering data center security. While OpenSSL offers support Venafi stands out for its automated certificate management and Sensu provides adaptable and scalable mon- itoring solutions. The combined use of these tools is suggested to enhance security measures and operational effectiveness within data centers. Recommendations for industry implementation and potential areas, for study are also explored.

In this paper, starting with the current security issues of the Ethernet data center, the author put forward the solutions for the secure data centers. The solutions are based on a security infrastructure, framed according to border protection, and The depth detection as the core of the secure data center solutions. It is apparent to penetrate the concept of security to the entire data center network design, deployment, and operation and maintenance.

Chapter 15 - Intelligent Video Analytics

Accurate prediction of data center workload, an important technology of cloud computing, is particular in improving resource utilization and reducing energy consumption. However, the workload presents a quasi-volatile, is challenging to obtain accurate results in cloud resource management. In this paper, the three-way ensemble prediction for workload in the data center is first proposed to improve the accuracy of the prediction. Moreover, we first defined the workload as the stable period, the volatility period, and the jitter period and adopted a simulated annealing algorithm to learn the optimal threshold to divide the workload. Then, according to the basic idea of the three-way decision, we assigned various prediction models based on workload characteristics and a priori error prediction to improve the prediction accuracy further. Finally, all the experimental results carried on the CPU load monitoring logs from Google cluster trace and compared with ARIMA, NN, and DMASVR-3WD, TWD-RCPM improve the accuracy of workload prediction by 69.0%, 68.6% and 72.6%, respectively.

A fault diagnosis method for VRLA battery in data center

Cloud providers generally run one or more Virtual Machine (VM) instances on the same physical machine. Though it increases data center utilization, it exposes VM to a co-location attack. VM placement and migration are the two strategies adopted for mitigating co-locations. Current methods for VM placement or VM migration consider only security as decision criteria and do not consider other factors like Quality-of-Service degradation, data center utilization, etc. This work proposes a placement and migration strategy for mitigation of co-location attacks with joint consideration of multi objectives like QoS, data center utilization, energy consumption, and security risks. A security-driven multi-criteria optimization -based VM placement policy is proposed. A joint consideration of multiobjective performance optimization along with co-location security risk minimization is done to design a novel VM placement policy based on user categorization. The policy can reduce the likelihood of co-location target VM with attacker VM without much degradation to the performance of VM and data center utilization. The solution mitigates co-location risks without much compromise to the performance of VM and data center resource utilization. The co-residence risk is mitigated by the categorization of users into three levels i.e. unlabeled, risky, and safe, and physical machines into two groups as safe and unsafe. The PMs available in data center is grouped into three different VM placement policies, they are undecided pool, safe pool and unsafe pool.

Cloud computing is next generation of Internet technology and data centers. As such, Information security (IS) has become one of the most essential issues of data center security on the cloud computing, but we cannot rely solely on single solution to support all of the necessary features of IS. Therefore, we need to a new information security service model, called Security Operation Center (SOC). It can support online interactions and remote monitoring via network operations in data centers. The SOC is required to integrate related IS technologies based on security policies. In this paper, we propose the service level agreement (SLA) strategy for designing the SOC platform to meet the IS requirements of any organization in cloud computing. Therefore, the main purposes of this paper are to propose the framework of SLA strategy and the integration technology for designing an SOC platform. The SOC platform with SLA is to handle and supervise all the security service processes under different levels of cloud security enforcements according to data center scales, business properties, and existing IS functions. Consequently, the SLA strategy and integrating technology of IS can be the reference model for designing a proposed SOC platform in data centers on the cloud computing.

With1 the advent of quantum computers, encryption technologies such as RSA and ECC, which currently protect data integrity, are at risk of being compromised with ease. This development poses significant threats to the security of cloud computing and data centers. Additionally, the Random Number Generators (RNGs) that form the foundation of existing encryption systems may also become predictable under quantum computer attacks, necessitating the introduction of new RNGs. This paper introduces four widely used Pseudorandom Number Generators (PRNGs) and three Quantum Random Number Generators (QRNGs), evaluating their randomness, speed, and data range using TestU01 and other analytical tools. The evaluation results demonstrate that the strengths and weaknesses of RNGs differ in terms of speed, randomness, and implementation complexity, emphasizing the importance of selecting the appropriate RNG based on the priority factors of each service.

Aggressively provisioned data centers achieve great cost savings by over-committing the very expensive power distribution infrastructure. However, existing proposals for managing load power demand in such a data center are largely utilization-driven, overlooking power-related interferences among users. An important observation is that some tasks can impact existing power budget management framework and disrupt normal operation by taking away the precious public power capacity. This vulnerability exposes data centers to a new type of risk that we call power grab, which is essentially hostile power resource competition. It could worsen the performance-utilization tradeoff in a power-constrained computing environment. Anticipating a growing case for power-oriented com-petition, we propose CFP, a resilient power capacity management frame-work for improving the fairness and service quality in scale-out data centers. Our solution features a market-based power re-source allocation and billing scheme that involves users in the loop. It allows the data center to bypass the formidable task of identifying malicious users and defend against power grab with reward and punishment incentives. We build a proof-of-concept system and also evaluate our design with realistic Google cluster traces. Compared to prior arts, CFP can increase the average performance-cost ratio by 1.8X. It can boost the total throughput in an APDC by 15% under severe power contention. Our design allows scale-out data centers to safely exploit the benefits that power over-subscription may provide, with minor overhead.

The author describes difficulties that have evolved in the application of flooded lead-acid batteries to uninterruptible power systems (UPS) service. It is suggested that industry pressures for greater power densities appear to have resulted in developments that may have been counter-productive to the service life of the UPS cells. The high-current, short-term discharge characteristics that are desirable for UPS applications result in battery designs tuned to less than optimum life. Uninterruptible power systems are generally applied to large computer data centers. The data center managers, who administer these applications, tend to be less informed on the life/construction characteristics of batteries that can result in unforeseen and severe economic losses for their management. The author describes efforts by the IEEE to provide applications documentation designed to reduce this information gap, to bring the matter out into the open, and to reduce these competitive pressures on the battery and UPS industries. >

Effective cooling is crucial for optimal data center performance and reliability. However, addressing environmental factors that affect data center operation and uptime remains a research gap. This chapter proposes the Real-Time Environment Monitoring and Alert System (RTEMAS) as a comprehensive solution, utilizing ESP32-based IoT devices and the MQTT protocol for scalable and secure data center monitoring. The system communicates using the ESP-NOW protocol based on (Wireless Sensor Networks) WSNs., transmitting real-time data to a central hub for remote monitoring. Temperature, humidity, air quality and airflow are monitored using sensors, analytics and intuitive dashboards. We utilize best practices recommended by the American Society of Heating, Refrigerating, and AirConditioning Engineers (ASHRAE) for temperature and humidity control. RTEMAS demonstrates its effectiveness, scalability and security through experimental validation. Compared to traditional solutions like Enviromux, and Data loggers, RTEMAS offers a cost-effective and flexible approach with remote monitoring capabilities, wireless sensor connectivity and broader environmental monitoring functionalities. This research addresses the research gap by providing a comprehensive data center environmental monitoring solution.

Chapter 4 - Domain 4: Physical (Environmental) Security