Cache Side Channel Research Articles

A Browser Fingerprint Authentication Scheme Based on the Browser Cache Side-Channel Technology

A Browser Fingerprint Authentication Scheme Based on the Browser Cache Side-Channel Technology

WITHDRAWN: CSCAD: An adaptive LightGBM algorithm to detect cache side-channel attacks

Cache side-channel attacks have become more sophisticated and more destructive to the security of computer architectures than ever before, which can obtain the plaintext of a victim without key. To address the challenges introduced by cache side-channel attacks, anomaly detection and feature detection were proposed. However, these methods have drawbacks in terms of computational performance and detection effectiveness. In this paper, we proposed a Cache Side-Channel Attack Detector (CSCAD), a novel tool for detecting cache side-channel attacks against memory events. Specifically, we design a collector using Hardware Performance Counters and use improved Maximum Information Coefficient to generate feature vectors. Meanwhile, an adaptive genetic algorithm with crossover and mutation probability is proposed to optimize the hyperparameters of LightGBM. Additionally, an adaptive loss function weight model with low overhead is introduced to enhance the efficiency of attack detection. It is encouraging to see that CSCAD achieved a recall of 98.14%. In detecting 1000 samples, it boosted the detection speed by approximately 75% compared to conventional machine learning methods. CSCAD has outperformed the state-of-the-art methods by simultaneously achieving excellent detection speed and effectiveness.

Lightweight Hardware-Based Cache Side-Channel Attack Detection for Edge Devices (Edge-CaSCADe)

Cache Side-Channel Attacks (CSCAs) have been haunting most processor architectures for decades now. Existing approaches to mitigation of such attacks have certain drawbacks, namely software mishandling, performance overhead, and low throughput due to false alarms. Hence, “mitigation only when detected” should be the approach to minimize the effects of such drawbacks. We propose a novel methodology of fine-grained detection of timing-based CSCA using a hardware-based detection module. We discuss the design, implementation, and use of our proposed detection module in processor architectures. Our approach successfully detects attacks that flush secret victim information from cache memory like Flush+Reload, Flush+Flush, Prime+Probe, Evict+Probe, and Prime+Abort, commonly known as cache timing attacks. Detection is on time with minimal performance overhead. The parameterizable number of counters used in our module allows detection of multiple attacks on multiple sensitive locations simultaneously. The fine-grained nature ensures negligible false alarms, severely reducing the need for any unnecessary mitigation. The proposed work is evaluated by synthesizing the entire detection algorithm as an attack detection block, Edge-CaSCADe, in a RISC-V processor as a target example. The detection results are checked under different workload conditions with respect to the number of attackers and the number of victims having RSA-, AES-, and ECC-based encryption schemes like ECIES, and on benchmark applications like MiBench and Embench. More than 98% detection accuracy within 2% of the beginning of an attack can be achieved with negligible false alarms. The detection module has an area and power overhead of 0.9% to 2% and 1% to 2.1% for the targeted RISC-V processor core without cache for one to five counters, respectively. The detection module does not affect the processor critical path and hence has no impact on its maximum operating frequency.

SecurityCloak: Protection against cache timing and speculative memory access attacks

Microarchitectural innovations such as deep cache hierarchies, out-of-order execution, branch prediction and speculative execution in modern processors have made possible to meet ever-increasing demands for performance. However, these innovations have inadvertently introduced vulnerabilities that are exploited by cache-side channel attacks such as Flush & Reload, Prime & Probe, Evict & Time, and attacks such as Spectre and Meltdown that exploit speculative executions. These attacks can potentially leak information which should be secured.Mitigating the attacks while preserving the performance of out-of-order execution has been a challenge. Previous hardware mitigation techniques against cache timing or side-channel attacks include complex cache indexing mechanisms, encrypting addresses, partitioning cache memories, assigning specific ways of a set for each process, or obfuscating cache accesses by using ghost threads. Previous techniques for preventing or at least mitigating attacks based on speculative executions include hiding speculative data accesses using separate buffers or caches, or undoing the effects of speculation throughout program execution. Most techniques address either attacks that exploit speculation such as Spectre or cache side-channel attacks but not both. In many cases, changes to the microarchitecture with additional hardware are needed to implement the security protection. In some cases the mitigations cause performance penalties. In contrast we present very simple designs aimed at preventing both timing based cache side-channel attacks and Spectre style attacks based on speculative executions. Our approach combines obfuscation of cache timing making it more difficult for side-channel attacks to succeed and delaying speculative data accesses that miss in cache until the speculation is resolved. We will show that these approaches prevent both timing attacks such as Flush & Reload, Prime & Probe, Evict & Time as well as speculative attacks such as Spectre. Our technique requires very minimal changes to hardware.

Deep Learning-Based Detection for Multiple Cache Side-Channel Attacks

Deep Learning-Based Detection for Multiple Cache Side-Channel Attacks

Quantifying and Mitigating Cache Side Channel Leakage with Differential Set

Cache side-channel attacks leverage secret-dependent footprints in CPU cache to steal confidential information, such as encryption keys. Due to the lack of a proper abstraction for reasoning about cache side channels, existing static program analysis tools that can quantify or mitigate cache side channels are built on very different kinds of abstractions. As a consequence, it is hard to bridge advances in quantification and mitigation research. Moreover, existing abstractions lead to imprecise results. In this paper, we present a novel abstraction, called differential set, for analyzing cache side channels at compile time. A distinguishing feature of differential sets is that it allows compositional and precise reasoning about cache side channels. Moreover, it is the first abstraction that carries sufficient information for both side channel quantification and mitigation. Based on this new abstraction, we develop a static analysis tool DSA that automatically quantifies and mitigates cache side channel leakage at the same time. Experimental evaluation on a set of commonly used benchmarks shows that DSA can produce more precise leakage bound as well as mitigated code with fewer memory footprints, when compared with state-of-the-art tools that only quantify or mitigate cache side channel leakage.

Towards a metrics suite for evaluating cache side-channel vulnerability: Case studies on an open-source RISC-V processor

Caches are key microarchitectural components of modern processors to improve memory access speed. However, attackers can readily implement timing side-channel attacks by exploiting the inherent time difference between cache hits and misses, which brings serious security threats to computer systems. In recent years, cache attacks have achieved fruitful consequences regarding attack techniques, targets, and platforms. At the same time, in order to measure the cache vulnerability, researchers have been looking at verifying the security policies and have proposed a variety of evaluation metrics. However, there are certain limitations in the current metrics, such as harsh assumptions, the distinguishing ability cannot be maintained all the time, the false positive and false negative noises can not be explicitly quantified, other tools are needed, and the verification environment is difficult to reproduce. To face these issues, we proposed a set of evaluation metrics, which includes the highest score (HS), minimum rounds to disclosure (MRD), and key score scissors differential (KSSD); we give the formal expressions in practice and theoretical, respectively. In order to facilitate the accurate reproduction of the experimental environment and results, we build a dual-core RISC-V bare-metal system based on the open-source framework Chipyard. On this basis, we conduct comprehensive evaluations to exploit vulnerabilities within the RISC-V cache architecture to verify the validity of the metrics suite. Furthermore, we compared the metrics with the commonly used success rate (SR) and guessing entropy (GE). The comparison results show that our proposed metrics suite can accurately depict the effects of attacks. Moreover, KSSD can maintain discrimination and converge quickly; MRD has more practical guidance; HS can specifically describe false negative noises. Finally, we perform a theoretical evaluation of AES algorithms with different T-table implementations using the proposed metrics, analyze the system's false positive and false negative noises, and suggest how the number of cache evictions can be determined under the random replacement policy.

Toward an Optimal Countermeasure for Cache Side-Channel Attacks

In the last 15 years, we have witnessed a never ending arm’s race between the attacker and the defender with respect to cache-based side-channel attacks. We have seen a slew of attacks, countermeasures (CMs), counterattacks, counter-countermeasures and so on. We analyze the evolution of this area, propose three necessary conditions for designing a successful CM, and then analyze timing and address-based CMs for popular algorithms such as AES and PRESENT. We show that an optimal yet trivial solution for timing-based CMs is possible. Furthermore, address-based CMs are inferior to timing-based CMs, and they can be broken in O(nlog(log(n))) time.

ENCIDER: Detecting Timing and Cache Side Channels in SGX Enclaves and Cryptographic APIs

Confidential computing aims to secure the code and data in use by providing a Trusted Execution Environment (TEE) for applications using hardware features such as Intel SGX. Timing and cache side-channel attacks, however, are often outside the scope of the threat model, although once exploited they are able to break all the default security guarantees enforced by hardware. Unfortunately, tools detecting potential side-channel vulnerabilities within applications are limited and usually ignore the strong attack model and the unique programming model imposed by Intel SGX. This article proposes a precise side-channel analysis tool, ENCIDER, detecting both timing and cache side-channel vulnerabilities within SGX applications via inferring potential timing observation points and incorporating the SGX programming model into analysis. ENCIDER uses dynamic symbolic execution to decompose the side-channel requirement based on the bounded non-interference property and implements byte-level information flow tracking via API modeling. We have applied ENCIDER to 4 real-world SGX applications, 2 SGX crypto libraries, and 3 widely-used crypto libraries, and found 29 timing side channels and 73 code and data cache side channels. We also compare ENCIDER with three state-of-the-art side channel analysis tools using their benchmarks. ENCIDER does not only report most of the bugs with 20%-50% run time improvement and 65%-92% memory usage improvement, but also detects 9 missing bugs from these tools. We have reported our findings to the corresponding parties, e.g., Intel and ARM, who have confirmed most of the vulnerabilities detected.

Preventing Coherence State Side Channel Leaks Using TimeCache

Cache side channel attacks in the presence of shared memory have been used to extract cryptographic keys and enclave data, and are used by Spectre variants for leaking speculatively loaded data. Timing side channels exist in shared caches due to the difference in response latency of cached and uncached data. In prior work, we presented TimeCache, a cache design that prevents side channel exploits from reuse of shared memory. In this work, we extend TimeCache to also defend against attacks that exploit coherence states. TimeCache allows all running applications to use the entire cache, avoiding the need for partitioning in order to effect timing isolation. A per-process caching context prevents cache hits on data filled by another process. A novel bit-serial timestamp-parallel comparison logic allows low-overhead update of stale caching contexts. The defense is suited to all caches levels, and defends against an attacker running on any core. We evaluate TimeCache using the gem5 simulator to show that it is capable of preventing both reuse attacks and an attack based on coherence state leak. The average performance overhead for SPEC2006 is 1.13%, and for PARSEC and SPLASH is 0.46%.

A Small Dummy Disrupting Database Reconstruction in a Cache Side-Channel Attack

A Small Dummy Disrupting Database Reconstruction in a Cache Side-Channel Attack

Ownership Verification of DNN Architectures via Hardware Cache Side Channels

Deep Neural Networks (DNN) are gaining higher commercial values in computer vision applications, e.g., image classification, video analytics, etc. This calls for urgent demands of the intellectual property (IP) protection of DNN models. In this paper, we present a novel watermarking scheme to achieve the ownership verification of DNN architectures. Existing works all embedded watermarks into the model parameters while treating the architecture as public property. These solutions were proven to be vulnerable by an adversary to detect or remove the watermarks. In contrast, we claim the model architectures as an important IP for model owners, and propose to implant watermarks into the architectures. We design new algorithms based on Neural Architecture Search (NAS) to generate watermarked architectures, which are unique enough to represent the ownership, while maintaining high model usability. Such watermarks can be extracted via side-channel-based model extraction techniques with high fidelity. We conduct comprehensive experiments on watermarked CNN models for image classification tasks and the experimental results show our scheme has negligible impact on the model performance, and exhibits strong robustness against various model transformations and adaptive attacks.

Dynamic First Access Isolation Cache to Eliminate Reuse-Based Cache Side Channel Attacks

Cache side channel attacks have been used to extract users’ sensitive information such as cryptographic keys. In particular, the reuse-based cache side channel attacks exploit the shared code or data between the attacker and the victim, which can steal the secret with high speed and precision. It has threatened not only the host level but also the cloud level severely. Previous defensive measures are either not flexible enough, or cause a high performance or storage overhead. In this work, we present a dynamic first access isolation cache that eliminates reuse-based cache side channel attacks by providing fine grained first access isolation to overcome these problems. First of all, there are [Formula: see text] bits in each cache line to record the access information and prevent the first time cache hit state brought by the victim from being utilized by the attacker while keeping data shared. Second, we use hierarchy security levels and domains to achieve flexible one way isolation between different domains, and the domains can be a group of processes, a single process, or even a fraction of code. Finally, the monitoring-driven dynamic scheduling mechanism can change the level of a domain at run time, which improves the robustness of this new design. The solution works at all the cache levels and defends against attackers running both on local and cloud. Our implementation in the Zsim simulator demonstrates that the performance overhead for standard performance evaluation corporation 2017 is less than 0.1%, and 0.21% for the multi-thread benchmarks. It performs better than the original first time miss design because of the one way isolation in our design. The only hardware modification is the [Formula: see text] bits per cache line, and several security registers per hardware context, which only brings 3.71% storage overhead.

A State Transition Based Cache Side Channel Attack Model

Over the last decades, the Cache Side Channel Attack (CSCA) seriously threatens the security of user information, which repeatedly highlights the security of cache. Even though the secure cache design can mitigate or defend against this attack, the high design period and tap-out cost reduce the development of the specific designs. Therefore, many researchers focus on proposing a secure cache model to analyse the CSCA and simplify the secure design. Nowadays, the cache model can be divided into 1) Indicator analysis model; 2) Cache verify model; 3) Cache abstract model. However, most of these models focus on the establishment phase of CSCA, regardless of the usage phase of CSCA. On the other hand, the granularity of the cache model is either the entire cache or a single cache line, which can’t describe the cache behaviour in CSCA clearly. To overcome these limitations, we proposed a novel cache model based on state transition and gave a formal specification of CSCA by this model in this work. Firstly, we summarize 11 basic states of the cache set and point to the target state in the process of CSCA. Then we describe the CSCA from three aspects: pre-attack cost, state transition cost, and detection accuracy, which gives a more comprehensive analysis of CSCA.

Security Model for Randomization-based Protected Caches

Cache side-channel attacks allow adversaries to learn sensitive information about co-running processes by using only access latency measures and cache contention.This vulnerability has been shown to lead to several microarchitectural attacks. As a promising solution, recent work proposes Randomization-based Protected Caches (RPCs). RPCs randomize cache addresses, changing keys periodically so as to avoid long-term leakage. Unfortunately, recent attacks have called the security of state-of-the-art RPCs into question.In this work, we tackle the problem of formally defining and analyzing the security properties of RPCs. We first give security definitions against access-based cache sidechannel attacks that capture security against known attacks such as Prime+Probe and Evict+Probe. Then, using these definitions, we obtain results that allow to guarantee security by adequately choosing the rekeying period, the key generation algorithm and the cache randomizer, thus providing security proofs for RPCs under certain assumptions.

Thwarting Cache Side Channel Attacks with Encryption Address-Based Set Balance Cache

The deterministic memory-to-cache mapping used by cache side channel attack causes the leakage of sensitive information such as secret keys, which seriously threatens user security and highlights the need to defend against this kind of attack. Recent table-based secure cache design requires more space to store the entry while a purely encryption-based design needs complex encryption units to ensure robustness. What is more, the newer attack algorithm enabling faster eviction set discovery may still break such defenses. Even though increasing the association of cache can be a potential solution, it introduces too much redundancy cache access and storage overhead. In this paper, we eliminate this problem. We present Encryption address-based Set Balance Cache (ESBC), a novel cache design to mitigate cache-based side channel attack. ESBC encrypts an address into two-level sets and displaces the data from a primary set into the secondary set when the primary set is full. The two-level mapping structure increases the complexity for attackers to build eviction sets, which is a vital step for the conflict-based attack. Furthermore, we adopt two different optimized variants from a temporal perspective, ESBC with remapping (ESBCR), which serves dynamic-remapping, and spatial perspective, ESBC with multi-mapping (ESBCM), which performs multi-mapping to improve the robustness. Our security analysis reveals that these designs can confuse the exploitation of conflicting addresses. Simulation-based evaluation on SPEC2017 shows 0.24% instruction per cycle (IPC) degradation for ESBCR with 1% remap rate. While the reduction of ESBCM that has five potential secondary sets is 0.69%. What is exciting is that both miss per kilo instructions (MPKI) and miss rates are even reduced because of the efficient cache usage. The storage overhead of these two variants is only 0.87%. By comparing the two schemes, we can observe that though ESBCR brings less performance overhead, the ESBCM has better scalability.

Secure hybrid replacement policy: Mitigating conflict-based cache side channel attacks

Conflict-based attacks on the last-level cache (LLC) are the most threatening cache side channel attack scenarios, where attackers exploit cache set conflicts as a channel to obtain sensitive cache accesses of victims. In this paper, we observe that conflict-based attacks cause exploited cache sets to experience an abnormally large number of accesses. Protecting these sets with suspicious access patterns effectively interferes with the attacker’s observation and thus mitigates such attacks. Based on this insight, we propose Secure Hybrid Replacement Policy (SHRP). SHRP captures suspicious sets by counting the number of accesses and alters their replacement policy to introduce noise into the attacker’s probe. Specifically, When a request occurs an LLC hit, SHRP has a certain probability of sending an invalidation request to the suspicious set. If a request triggers an LLC replacement, SHRP has a certain probability of turning the request uncacheable. Because of these probabilistic obscuring actions, attackers are impossible to accurately infer the victim’s behaviors on the protected cache set. The evaluation demonstrates that SHRP efficiently mitigates conflict-based attacks and induces negligible performance impacts and acceptable storage overhead.

CacheHawkeye: Detecting Cache Side Channel Attacks Based on Memory Events

Cache side channel attacks, as a type of cryptanalysis, seriously threaten the security of the cryptosystem. These attacks continuously monitor the memory addresses associated with the victim’s secret information, which cause frequent memory access on these addresses. This paper proposes CacheHawkeye, which uses the frequent memory access characteristic of the attacker to detect attacks. CacheHawkeye monitors memory events by CPU hardware performance counters. We proved the effectiveness of CacheHawkeye on Flush+Reload and Flush+Flush attacks. In addition, we evaluated the accuracy of CacheHawkeye under different system loads. Experiments demonstrate that CacheHawkeye not only has good accuracy but can also adapt to various system loads.

A Systematic Study on Spectre Attacks and Defenses

Spectre attacks is an important category of side channel methods, which allows attacker to obtainsensitive data by observing the system. Spectre attacks exploit modern processors’ features designedfor the performance: out-of-order execution and speculative execution. Also, in Spectre attacks,cache side-channel attack methods play an important role. The high-level goal of Spectre attacksis to load target data into the cache through the speculative execution. Once it has been done, thenext step is leaking information. To the end, the cache side-channel methods are employed to leakinformation, because there is no direct way to read data from the cache. In this paper, we discussvariations of Spectre attacks and discuss defense mechanisms for each of them.

SpecSafe: detecting cache side channels in a speculative world

The high-profile Spectre attack and its variants have revealed that speculative execution may leave secret-dependent footprints in the cache, allowing an attacker to learn confidential data. However, existing static side-channel detectors either ignore speculative execution, leading to false negatives, or lack a precise cache model, leading to false positives. In this paper, somewhat surprisingly, we show that it is challenging to develop a speculation-aware static analysis with precise cache models: a combination of existing works does not necessarily catch all cache side channels. Motivated by this observation, we present a new semantic definition of security against cache-based side-channel attacks, called Speculative-Aware noninterference (SANI), which is applicable to a variety of attacks and cache models. We also develop SpecSafe to detect the violations of SANI. Unlike other speculation-aware symbolic executors, SpecSafe employs a novel program transformation so that SANI can be soundly checked by speculation-unaware side-channel detectors. SpecSafe is shown to be both scalable and accurate on a set of moderately sized benchmarks, including commonly used cryptography libraries.