Cache-based Side Channel Research Articles

There’s Always a Bigger Fish: A Clarifying Analysis of a Machine-Learning-Assisted Side-Channel Attack

<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Machine learning has made it possible to mount powerful attacks through side channels that are otherwise challenging to exploit. However, due to the black-box nature of machine learning models, these attacks can be difficult to interpret correctly. Models that simply find correlations cannot be used to analyze the various sources of information leakage behind an attack. This article highlights the limitations of relying on machine learning for side-channel attacks without completing a comprehensive security analysis. We show that a state-of-the-art website-fingerprinting attack powered by machine learning was only partially analyzed. Its authors were misled into believing their attack exploited a cache-based side channel, when it actually exploited an interrupt-based side channel. We demonstrate this through a comprehensive analysis, in which we run controlled experiments to rule out alternative hypotheses about the attack’s primary source of leakage, and ultimately instrument the attack’s code to prove our hypothesis.</i>

Cache-Based Side-Channel Attack Mitigation for Many-Core Distributed Systems via Dynamic Task Migration

Side-channel attacks (SCA) are a serious threat to cryptographic systems due to mostly unavoidable information leakage. Cache-based SCAs take advantage of cache inherent timing properties on shared memory systems to extract security-critical information. In this paper, we present a novel approach to mitigate cache-based SCAs on distributed many-core systems, based on a resource management technique. Our solution leverages dynamic task migration as a mechanism to ensure a secure execution scenario for security-critical applications. Additionally, we propose a resource-management-based mechanism to ensure a secure execution when migration is not possible due to a lack of available resources. We evaluate our solution in terms of gained security and performance impact using the Sniper simulator for different configurations. Results show that our technique effectively develops resilience against SCAs, while causing a low performance slowdown (1.6% on average, 9% worst case). For all tested benchmarks, our worst-case performance slowdown is 20% less than a state-of-the-art countermeasure. Moreover, our solution utilizes less than 1 ms of system run-time overhead for a 64 core platform with 100% utilization.

Transient Execution and Side Channel Analysis: a Vulnerability or a Science Experiment?

In the world of computer security, attackers are constantly looking for new exploits to gain data from or control over a computer system. One category of exploit that can prove quite effective at accessing privileged data is side channel exploits. These exploits attempt to take advantage of vulnerabilities that are inherent in the design of a system rather than vulnerabilities in the code that has been written for and is running on said system. In other words, they exploit side effects of computation. Examples of this include measuring the power consumption of a system’s processor over time and analysing that power usage to leak system secrets or reading secrets from a system by analysing the electromagnetic radiation the system leaks as it processes data. Another type of side channel attack is a cache-based side channel attack, which exploits the timings of cache and memory accesses to determine data from the target system. We discuss some of the more common types of side channel attacks used to interpret data values from the microarchitectural changes created by transient executions. In particular, we will focus on attacks that are capable of recovering data that is processed through transient execution in some way and then wrongly accessed using a side channel, such as the Spectre and Meltdown classes of attack. We also discuss other attacks of a similar type and survey some popular mitigations for these attacks. We provide a survey of all available Spectre proof-of-concept repositories on GitHub, evaluating whether they work on different platforms. Finally, we review our experiences with these types of attacks on modern systems and comment on the attacks’ practicality, reliability, and portability. We conclude that these types of attacks are interesting, but there are some practicality and reliability concerns that make other attacks easier much of the time.

Thwarting Cache Side Channel Attacks with Encryption Address-Based Set Balance Cache

The deterministic memory-to-cache mapping used by cache side channel attack causes the leakage of sensitive information such as secret keys, which seriously threatens user security and highlights the need to defend against this kind of attack. Recent table-based secure cache design requires more space to store the entry while a purely encryption-based design needs complex encryption units to ensure robustness. What is more, the newer attack algorithm enabling faster eviction set discovery may still break such defenses. Even though increasing the association of cache can be a potential solution, it introduces too much redundancy cache access and storage overhead. In this paper, we eliminate this problem. We present Encryption address-based Set Balance Cache (ESBC), a novel cache design to mitigate cache-based side channel attack. ESBC encrypts an address into two-level sets and displaces the data from a primary set into the secondary set when the primary set is full. The two-level mapping structure increases the complexity for attackers to build eviction sets, which is a vital step for the conflict-based attack. Furthermore, we adopt two different optimized variants from a temporal perspective, ESBC with remapping (ESBCR), which serves dynamic-remapping, and spatial perspective, ESBC with multi-mapping (ESBCM), which performs multi-mapping to improve the robustness. Our security analysis reveals that these designs can confuse the exploitation of conflicting addresses. Simulation-based evaluation on SPEC2017 shows 0.24% instruction per cycle (IPC) degradation for ESBCR with 1% remap rate. While the reduction of ESBCM that has five potential secondary sets is 0.69%. What is exciting is that both miss per kilo instructions (MPKI) and miss rates are even reduced because of the efficient cache usage. The storage overhead of these two variants is only 0.87%. By comparing the two schemes, we can observe that though ESBCR brings less performance overhead, the ESBCM has better scalability.

Interpretable noninterference measurement and its application to processor designs

Noninterference measurement quantifies the secret information that might leak to an adversary from what the adversary can observe and influence about the computation. Static and high-fidelity noninterference measurement has been difficult to scale to complex computations, however. This paper scales a recent framework for noninterference measurement to the open-source RISC-V BOOM core as specified in Verilog, through three key innovations: logically characterizing the core’s execution incrementally, applying specific optimizations between each cycle; permitting information to be declassified, to focus leakage measurement to only secret information that cannot be inferred from the declassified information; and interpreting leakage measurements for the analyst in terms of simple rules that characterize when leakage occurs. Case studies on cache-based side channels generally, and on specific instances including Spectre attacks, show that the resulting toolchain, called DINoMe, effectively scales to this modern processor design.

VM placement and cache based side channel attack at computational level in cloud computing : A Survey

There are different issues that need to focus in respect of security and privacy. One of the most security issue at computational level implementation of secure virtualization is cloud computing. In this, we explain virtualization security and their existing defense system at computational level. In computational level need to increase security of cloud and categorized the virtual machine level security challenges that are faced by cloud users at computational level in cloud computing. Day by day cloud attribute are introducing new challenges in cloud environment. In this paper, we focus on cloud security at computational level. In the day scenario to secure a cloud data on shared environment is the important task for IT industries. In virtual environment need to focus on secure VM placement on the host machine that is running on cloud. This paper demonstrates lack of VM placement and side channel attack (SCA). Analysis of different type of scheme is done and comparative study of game theory based, graph theory based and bin packing VM placement scheme. Also we discussed virtualization in cloud computing and their security aspects and comparative study of different type side channel attack (SCA).

Survey of CPU Cache-Based Side-Channel Attacks: Systematic Analysis, Security Models, and Countermeasures

Privacy protection is an essential part of information security. The use of shared resources demands more privacy and security protection, especially in cloud computing environments. Side-channel attacks based on CPU cache utilize shared CPU caches within the same physical device to compromise the system’s privacy (encryption keys, program status, etc.). Information is leaked through channels that are not intended to transmit information, jeopardizing system security. These attacks have the characteristics of both high concealment and high risk. Despite the improvement in architecture, which makes it more difficult to launch system intrusion and privacy leakage through traditional methods, side-channel attacks ignore those defenses because of the shared hardware. Difficult to be detected, they are much more dangerous in modern computer systems. Although some researchers focus on the survey of side-channel attacks, their study is limited to cryptographic modules such as Elliptic Curve Cryptosystems. All the discussions are based on real-world applications (e.g., Curve25519), and there is no systematic analysis for the related attack and security model. Firstly, this paper compares different types of cache-based side-channel attacks. Based on the comparison, a security model is proposed. The model describes the attacks from four key aspects, namely, vulnerability, cache type, pattern, and range. Through reviewing the corresponding defense methods, it reveals from which perspective defense strategies are effective for side-channel attacks. Finally, the challenges and research trends of CPU cache-based side-channel attacks in both attacking and defending are explored. The systematic analysis of CPU cache-based side-channel attacks highlights the fact that these attacks are more dangerous than expected. We believe our survey would draw developers’ attention to side-channel attacks and help to reduce the attack surface in the future.

A Survey of Cache-Based Side Channel Countermeasure

A Survey of Cache-Based Side Channel Countermeasure

Modified Cache-Template Attack on AES

While it has been known for a long time that the cache behavior is a powerful source of the information leakage, more realistic attack scenarios have received a lot of attention by the cryptographic community. To develop practical cache-based attacks, there is an increasingly need to automate the process of finding exploitable cache-based side-channels in computer systems. Cache template attack is a generic technique that utilizes Flush+Reload attack in order to automatically exploit cache vulnerability of Intel platforms. Cache template attack on T-table-based AES implementation consists of two phases including the profiling phase and the key exploitation phase. Profiling is a preprocessing phase to monitor dependencies between the secret key and behavior of the cache memory. In addition, the addresses of T-tables can be obtained automatically. In the key exploitation phase, most significant bits (MSBs) of the secret key bytes are retrieved by monitoring exploitable addresses. In this paper, we propose a simple yet effective searching technique which accelerates the profiling phase by a factor of at most 64. To verify the theoretical model of our technique, we implement the described attack on AES. The experimental results confirmed a shorter runtime of the attack in comparison to the original attack.

An optimistic technique to detect Cache based Side Channel attacks in Cloud

Data security is the most critical field in Cloud Computing. The Critical data can leak through unpredictable side channels, posing very risky threats to information security. The Cache-based Side Channel Attacks (CSCAs) is one of the most challenging attacks. Different secure cache architectures have been proposed to defend against these attacks. But these solutions are not reliable to detect and prevent those attacks. Detection of CSCAs is a very important research-related problem. In this paper we demonstrated the detection of CSCAs. We measured the vCPU cycle, virtual memory utilization and cache miss rate to detect the attackers. We illustrated Prime + Probe attack, Flush + Flush attack, and Flush + Reload attack on the AES cryptosystem. Our detection technique is compared with the existing detection solution to demonstrate the accuracy. Our proposed work is achieved 92.5% accuracy to detect the CSC attacks. With the help of our proposed system the Cloud Service Providers(CSPs) can identify the attackers of VMs and host machines to safe guard victim users from the CSCA.

Survey on Cache-Based Side-Channel Attacks in Cloud Computing

Survey on Cache-Based Side-Channel Attacks in Cloud Computing

Survey of Access-Driven Cache-Based Side Channel Attack

Survey of Access-Driven Cache-Based Side Channel Attack

Meet the Sherlock Holmes’ of Side Channel Leakage: A Survey of Cache SCA Detection Techniques

Cache Side Channel Attacks (SCAs) have gained a lot of attention in the recent past. Since, these attacks exploit the caching hardware vulnerabilities, they are fast and dangerous. Detection of cache side channel attacks is an important step towards mitigating against such hostile entities. Researchers have already proposed different techniques to detect cache side channel attacks. This paper provides a detailed survey of literature related to the state-of-the-art detection techniques for cache based side channel attacks. We identify a set of important characteristics that can be used to characterize a CSCA (cache side channel attack) detection technique. We use the identified features to compare and contrast the most important detection techniques and provide the important observations. We also identify some of the challenges that the research community will have to resolve in future to improve the efficiency of cache side channel detection techniques. To the best of our knowledge, this is the first work to do such a study. We believe that this paper will prove useful to researchers in the area of systems security.

Detecting Cache-Based Side Channel Attacks in IaaS using Enhanced Algorithm

The Connectivity of the information among people throughout the world is made possible through computers and smart devices connected over the internet. The economic related transactions also happen over the network which needs a secured transaction medium. Therefore, lots of intrusion detection and prevention systems are implemented in order to reduce the impact of the attack. But every year the impact of attack over the shared VMs is being dramatically increased. The economic transactions occur with the help of web applications and they are divided into browser-side and server-side components. One of the major services provided by the cloud environment is Infrastructure-asa-Service in which the virtual machines are used to provide the shared services to the multiple users. Though the VMs are secured by implementing the various security algorithms, one of the attacks, Side-channel attack, uses the leaked information acquired from the implementation of hardware component. Cache-based side channel attack is the serious attack, which tries to steal the sensitive information like credit card details, password, medical related details, etc., by establishing various algorithms like PRIME+PROBE, FLUSH+RELOAD, FLUSH+FLUSH, etc.,. The VM does speculative execution for improving the CPU performance, thus resulting in a scenario which allows the user to access the sensitive data on the cache line. So in this paper the environment is set up with 5 various scenarios with the combinations consisting of attack, no-attack, Full load, Average load and no-load. The Hardware Performance Counters (HPC) is used along with Intel CMT to monitor and distinguish the attacker VM, thus increasing the detection accuracy and reducing the system overhead.

CacheSCDefender: VMM-based Comprehensive Framework against Cache-based Side-channel Attacks

CacheSCDefender: VMM-based Comprehensive Framework against Cache-based Side-channel Attacks

A Way to Improve the Key Recovery Accuracy Based on Dynamic Programming

Key-recovery technology is often used by an adversary to attempt to recover the cryptographic key of an encryption scheme. The most obvious key-recovery attack is the exhaustive key-search attack. But modern ciphers often have a key space of size 2128 or greater, making such attacks infeasible with current technology. Cache-based side channel attack is another way to get the cryptographic key of an encryption scheme, but there are random noises in side channel attack. In order to reduce random errors, it is advisable to repeat the key recovery process many times. This paper is focused on the way to improve the key recovery accuracy by dealing with the key sequences obtained from the repeated Cache-based side channel attacks. To get the real key, private key bits from side channel attack are collected firstly. And then the key sequences are aligned using sequence alignment algorithms based on dynamic programming. The provided method of key recovery is universal, which is not limited to any cryptographic algorithm. The experiment shows that the proposed method has a good performance and a high availability when the error rate of the collected key bit is within a reasonable range.

Adaptive multilevel fuzzy-based authentication framework to mitigate Cache side channel attack in cloud computing

Cloud computing supports multitenancy to satisfy the users’ demands for accessing resources and simultaneously it increases revenue for cloud providers. Cloud providers adapt multitenancy by virtualizing the resources, like CPU, network interfaces, peripherals, hard drives and memory using hypervisor to fulfill the demand. In a virtualized environment, many virtual machines (VMs) can run on the same core with the help of the hypervisor by sharing the resources. The VMs running on the same core are the target for the malicious or abnormal attacks like side channel attacks. Among various side channel attacks in cloud computing, cache-based side channel attack is one that leaks private information of the users based on the shared resources. Here, as the shared resource is the cache, a process can utilize the cache usage of another by cache contention. Cache sharing provides a way for the attackers to gain considerable information so that the key used for encryption can be inferred. Discovering this side channel attack is a challenging task. This requires identification of a feature that influences the attack. Even though there are various techniques available in the literature to mitigate such attacks, an effective solution to reduce the cache-based side channel attack is still an issue. Therefore, a novel fuzzy rule-based mechanism is integrated to detect the cache side channel attackers by monitoring the cache data access (CDA). The factor that determines the attack is CDA in a log file created by the framework during authorization. The proposed framework also utilizes certain security properties including ECC and hashing for the privacy preservation and the decision is made with the aid of a fuzzy logic system.

Detection of Cache-based Side Channel Attack Based on Performance Counters

Side channel attack is typically used to get private key of cryptography system. It is one type of great threats to the cryptosystem. How to detect the attack effectively is an open problem. We proposed a way to detect the cache-based side channel attack using performance counters in this paper. Two main performance parameters, i.e. cache miss rate and dTLB miss rate are used here. The result showed that the cache-based side channel attack not only has a high cache miss rate even above 99.4%, but also has a low dTLB miss rate even below 0.002%. The experiments prove that this method can detect cache-based side channel attack accurately and quickly.

Leveraging KVM Events to Detect Cache-Based Side Channel Attacks in a Virtualization Environment

Cache-based side channel attack (CSCa) techniques in virtualization systems are becoming more advanced, while defense methods against them are still perceived as nonpractical. The most recent CSCa variant called Flush + Flush has showed that the current detection methods can be easily bypassed. Within this work, we introduce a novel monitoring approach to detect CSCa operations inside a virtualization environment. We utilize the Kernel Virtual Machine (KVM) event data in the kernel and process this data using a machine learning technique to identify any CSCa operation in the guest Virtual Machine (VM). We evaluate our approach using Receiver Operating Characteristic (ROC) diagram of multiple attack and benign operation scenarios. Our method successfully separate the CSCa datasets from the non-CSCa datasets, on both trained and nontrained data scenarios. The successful classification also include the Flush + Flush attack scenario. We are also able to explain the classification results by extracting the set of most important features that separate both classes using their Fisher scores and show that our monitoring approach can work to detect CSCa in general. Finally, we evaluate the overhead impact of our CSCa monitoring method and show that it has a negligible computation overhead on the host and the guest VM.

Secure Hierarchy-Aware Cache Replacement Policy (SHARP)

In cache-based side channel attacks, a spy that shares a cache with a victim probes cache locations to extract information on the victim's access patterns. For example, in evict+reload, the spy repeatedly evicts and then reloads a probe address, checking if the victim has accessed the address in between the two operations. While there are many proposals to combat these cache attacks, they all have limitations: they either hurt performance, require programmer intervention, or can only defend against some types of attacks. This paper makes the following observation for an environment with an inclusive cache hierarchy: when the spy evicts the probe address from the shared cache, the address will also be evicted from the private cache of the victim process, creating an inclusion victim. Consequently, to disable cache attacks, this paper proposes to alter the line replacement algorithm of the shared cache, to prevent a process from creating inclusion victims in the caches of cores running other processes. By enforcing this rule, the spy cannot evict the probe address from the shared cache and, hence, cannot glimpse any information on the victim's access patterns. We call our proposal SHARP (Secure Hierarchy-Aware cache Replacement Policy). SHARP efficiently defends against all existing cross-core shared-cache attacks, needs only minimal hardware modifications, and requires no code modifications. We implement SHARP in a cycle-level full-system simulator. We show that it protects against real-world attacks, and that it introduces negligible average performance degradation.