-
RollingCache: Using Runtime Behavior to Defend Against Cache Side Channel Attacks
Authors:
Divya Ojha,
Sandhya Dwarkadas
Abstract:
Shared caches are vulnerable to side channel attacks through contention in cache sets. Besides being a simple source of information leak, these side channels form useful gadgets for more sophisticated attacks that compromise the security of shared systems.
The fundamental design aspect that contention attacks exploit is the deterministic nature of the set of addresses contending for a cache set.…
▽ More
Shared caches are vulnerable to side channel attacks through contention in cache sets. Besides being a simple source of information leak, these side channels form useful gadgets for more sophisticated attacks that compromise the security of shared systems.
The fundamental design aspect that contention attacks exploit is the deterministic nature of the set of addresses contending for a cache set. In this paper, we present RollingCache, a cache design that defends against contention attacks by dynamically changing the set of addresses contending for cache sets. Unlike prior defenses, RollingCache does not rely on address encryption/decryption, data relocation, or cache partitioning. We use one level of indirection to implement dynamic mapping controlled by the whole-cache runtime behavior. Our solution does not depend on having defined security domains, and can defend against an attacker running on the same or another core.
We evaluate RollingCache on ChampSim using the SPEC-2017 benchmark suite. Our security evaluation shows that our dynamic mapping removes the deterministic ability to identify the source of contention. The performance evaluation shows an impact of 1.67\% over a mix of workloads, with a corresponding
△ Less
Submitted 26 August, 2024; v1 submitted 16 August, 2024;
originally announced August 2024.
-
Timing Cache Accesses to Eliminate Side Channels in Shared Software
Authors:
Divya Ojha,
Sandhya Dwarkadas
Abstract:
Timing side channels have been used to extract cryptographic keys and sensitive documents, even from trusted enclaves. In this paper, we focus on cache side channels created by access to shared code or data in the memory hierarchy. This vulnerability is exploited by several known attacks, e.g, evict+reload for recovering an RSA key and Spectre variants for data leaked due to speculative accesses.…
▽ More
Timing side channels have been used to extract cryptographic keys and sensitive documents, even from trusted enclaves. In this paper, we focus on cache side channels created by access to shared code or data in the memory hierarchy. This vulnerability is exploited by several known attacks, e.g, evict+reload for recovering an RSA key and Spectre variants for data leaked due to speculative accesses. The key insight in this paper is the importance of the first access to the shared data after a victim brings the data into the cache. To eliminate the timing side channel, we ensure that the first access by a process to any cache line loaded by another process results in a miss. We accomplish this goal by using a combination of timestamps and a novel hardware design to allow efficient parallel comparisons of the timestamps. The solution works at all the cache levels and defends against an attacker process running on another core, same core, or another hyperthread. Our design retains the benefits of a shared cache: allowing processes to utilize the entire cache for their execution and retaining a single copy of shared code and data (data deduplication). Our implementation in the GEM5 simulator demonstrates that the system is able to defend against RSA key extraction. We evaluate performance using SPECCPU2006 and observe overhead due to first access delay to be 2.17%. The overhead due to the security context bookkeeping is of the order of 0.3%.
△ Less
Submitted 16 December, 2021; v1 submitted 30 September, 2020;
originally announced September 2020.
-
Restricting Control Flow During Speculative Execution with Venkman
Authors:
Zhuojia Shen,
Jie Zhou,
Divya Ojha,
John Criswell
Abstract:
Side-channel attacks such as Spectre that utilize speculative execution to steal application secrets pose a significant threat to modern computing systems. While program transformations can mitigate some Spectre attacks, more advanced attacks can divert control flow speculatively to bypass these protective instructions, rendering existing defenses useless.
In this paper, we present Venkman: a sy…
▽ More
Side-channel attacks such as Spectre that utilize speculative execution to steal application secrets pose a significant threat to modern computing systems. While program transformations can mitigate some Spectre attacks, more advanced attacks can divert control flow speculatively to bypass these protective instructions, rendering existing defenses useless.
In this paper, we present Venkman: a system that employs program transformation to completely thwart Spectre attacks that poison entries in the Branch Target Buffer (BTB) and the Return Stack Buffer (RSB). Venkman transforms code so that all valid targets of a control-flow transfer have an identical alignment in the virtual address space; it further transforms all branches to ensure that all entries added to the BTB and RSB are properly aligned. By transforming all code this way, Venkman ensures that, in any program wanting Spectre defenses, all control-flow transfers, including speculative ones, do not skip over protective instructions Venkman adds to the code segment to mitigate Spectre attacks. Unlike existing defenses, Venkman does not reduce sharing of the BTB and RSB and does not flush these structures, allowing safe sharing and reuse among programs while maintaining strong protection against Spectre attacks. We built a prototype of Venkman on an IBM POWER8 machine. Our evaluation on the SPEC benchmarks and selected applications shows that Venkman increases execution time to 3.47$\times$ on average and increases code size to 1.94$\times$ on average when it is used to ensure that fences are executed to mitigate Spectre attacks. Our evaluation also shows that Spectre-resistant Software Fault Isolation (SFI) built using Venkman incurs a geometric mean of 2.42$\times$ space overhead and 1.68$\times$ performance overhead.
△ Less
Submitted 25 March, 2019;
originally announced March 2019.
-
Lexicographic Multi-objective Geometric Programming Problems
Authors:
Dr. A. K. Ojha,
K. K. Biswal
Abstract:
A Geometric programming (GP) is a type of mathematical problem characterized by objective and constraint functions that have a special form. Many methods have been developed to solve large scale engineering design GP problems. In this paper GP technique has been used to solve multi-objective GP problem as a vector optimization problem. The duality theory for lexicographic geometric programming h…
▽ More
A Geometric programming (GP) is a type of mathematical problem characterized by objective and constraint functions that have a special form. Many methods have been developed to solve large scale engineering design GP problems. In this paper GP technique has been used to solve multi-objective GP problem as a vector optimization problem. The duality theory for lexicographic geometric programming has been developed to solve the problems with posynomial in objectives and constraints.
△ Less
Submitted 9 December, 2009;
originally announced December 2009.
