Defensive techniques to increase computer security

1. A computer-implemented method comprising:

executing a plurality of virtual machines on a first physical machine, wherein a first virtual machine of the plurality of virtual machines executes an encryption process;

detecting, on a second virtual machine of the plurality of virtual machines, execution of a hostile process that is configured to compromise the encryption process executed by the first virtual machine, the detecting comprising:

determining a count representing read accesses to a clock by the hostile process, wherein the clock is within a central processing unit of the physical machine;

determining a rate of clock read accesses by the hostile process;

determining whether the rate of clock read accesses is beyond a clock read access threshold; and

detecting the execution of the hostile process based on the determination that the rate of clock read access is beyond the clock read access threshold; and

migrating at least the second virtual machine from the first physical machine to a second physical machine based on the detection of the execution of the hostile process, wherein the second physical machine is separate and distinct from the first physical machine.

2. The computer-implemented method of claim 1 wherein migrating at least the second virtual machine further comprises migrating the first virtual machine to a third physical machine.

3. The computer-implemented method of claim 1 wherein migrating at least the second virtual machine further comprises migrating the first virtual machine to the second physical machine at a time instance that is different than a time instance of migrating the second virtual machine.

4. The computer-implemented method of claim 1 wherein the second physical machine is not hosting a virtual machine executing an encryption process.

5. The computer-implemented method of claim 1 wherein the hostile process is configured to monitor events associated with the first virtual machine to determine a cryptographic key associated with the encryption process.

6. The computer-implemented method of claim 5 wherein the events associated with the first virtual machine include cache accesses.

7. The computer-implemented method of claim 6 wherein the cache accesses are associated with a cache associated with the physical machine.

8. The computer-implemented method of claim 1 wherein the process configured to compromise the encryption process comprises a side-channel attack.

9. The computer-implemented method of claim 1 further comprising determining that a processing load associated with the second physical machine is less than a load threshold before migrating the second virtual machine.

10. A system comprising:

a data processing apparatus configured to perform operations comprising:

executing a plurality of virtual machines on a physical machine, wherein a first virtual machine of the plurality of virtual machines executes an encryption process;

detecting, on a second virtual machine of the plurality of virtual machines, execution of a hostile process that is configured to compromise the encryption process executed by the first virtual machine, the detecting comprising:

determining a count representing read accesses to a clock by the hostile process, wherein the clock is within a central processing unit of the physical machine;

determining a rate of clock read accesses by the hostile process;

determining whether the rate of clock read accesses is beyond a clock read access threshold; and

detecting the execution of the hostile process based on the determination that the rate of clock read access is beyond the clock read access threshold; and

migrating at least the second virtual machine from the first physical machine to a second physical machine based on the detection of the execution of the hostile process, wherein the second physical machine is separate and distinct from the first physical machine.

11. The system of claim 10 wherein the data processing apparatus and the second data processing apparatus are associated with a cloud computing system.

12. The system of claim 10 wherein migrating at least the second virtual machine further comprises migrating the first virtual machine to a third data processing apparatus.

13. The system of claim 10 wherein migrating at least the second virtual machine further comprises migrating the first virtual machine to the second physical machine at a time instance that is different than a time instance of migrating the second virtual machine.

14. The system of claim 10 wherein the second data processing apparatus is not hosting a virtual machine executing an encryption process.

15. The system of claim 10 wherein the hostile process is configured to monitor events associated with the first virtual machine to determine a cryptographic key associated with the encryption process.

16. The system of claim 15 wherein the events associated with the first virtual machine include cache accesses.

17. The system of claim 16 wherein the cache accesses are associated with a cache associated with the data processing apparatus.

18. The system of claim 10 wherein the process configured to compromise the encryption process comprises a side-channel attack.

19. The system of claim 10 , wherein the operations further comprise determining that a processing load associated with the second data processing apparatus is less than a load threshold before migrating the second virtual machine.

20. A non-transitory computer storage medium having instructions stored thereon that, when executed by a data processing apparatus, cause the data processing apparatus to perform operations comprising:

executing a plurality of virtual machines on a physical machine, wherein a first virtual machine of the plurality of virtual machines executes an encryption process;

detecting, on a second virtual machine of the plurality of virtual machines, execution of a hostile process that is configured to compromise the encryption process executed by the first virtual machine, the detecting comprising:

determining a count representing read accesses to a clock by the hostile process, wherein the clock is within a central processing unit of the physical machine;

determining a rate of clock read accesses by the hostile process;

determining whether the rate of clock read accesses is beyond a clock read access threshold; and

detecting the execution of the hostile process based on the determination that the rate of clock read access is beyond the clock read access threshold; and

migrating at least the second virtual machine from the first physical machine to a second physical machine based on the detection of the execution of the hostile process, wherein the second physical machine is separate and distinct from the first physical machine.

21. The non-transitory computer storage medium of claim 20 wherein migrating at least the second virtual machine further comprises migrating the first virtual machine to a third physical machine.

22. The non-transitory computer medium of claim 20 wherein migrating at least the second virtual machine further comprises migrating the first virtual machine to the second physical machine at a time instance that is different than a time instance of migrating the second virtual machine.

23. The non-transitory computer medium of claim 20 wherein the second physical machine is not hosting a virtual machine executing an encryption process.

24. The non-transitory computer medium of claim 20 wherein the hostile process is configured to monitor events associated with the first virtual machine to determine a cryptographic key associated with the encryption process.

25. The non-transitory computer medium of claim 24 wherein the events associated with the first virtual machine include cache accesses.

26. The non-transitory computer medium of claim 25 wherein the cache accesses are associated with a cache associated with the physical machine.

27. The non-transitory computer medium of claim 20 wherein the process configured to compromise the encryption process comprises a side-channel attack.

28. The non-transitory computer medium of claim 20 wherein the operations further comprise determining that a processing load associated with the second physical machine is less than a load threshold before migrating the second virtual machine.