  The massive parallelism and resource sharing embodying today's cloud business
model not only exacerbate the security challenge of timing channels, but also
undermine the viability of defenses based on resource partitioning. We propose
hypervisor-enforced timing mitigation to control timing channels in cloud
environments. This approach closes "reference clocks" internal to the cloud by
imposing a deterministic view of time on guest code, and uses timing mitigators
to pace I/O and rate-limit potential information leakage to external observers.
Our prototype hypervisor is the first system to mitigate timing-channel leakage
across full-scale existing operating systems such as Linux and applications in
arbitrary languages. Mitigation incurs a varying performance cost, depending on
workload and tunable leakage-limiting parameters, but this cost may be
justified for security-critical cloud applications and data.
