论文标题
定时缓存访问以消除共享软件中的边频道
Timing Cache Accesses to Eliminate Side Channels in Shared Software
论文作者
论文摘要
定时侧通道已被用来提取加密密钥和敏感文档，即使是从受信任的飞地中也是如此。在本文中，我们专注于通过对内存层次结构中共享代码或数据访问创建的缓存侧渠道。该漏洞是通过几种已知攻击来利用的，例如驱逐+重新加载，用于恢复RSA密钥和Spectre变体，以泄露由于投机访问而泄漏的数据。本文中的关键见解是受害者将数据带入缓存后，首先访问共享数据的重要性。为了消除定时侧通道，我们确保过程第一次访问另一个过程加载的任何缓存线会导致失误。我们通过结合时间戳和新颖的硬件设计来实现这一目标，以允许对时间戳的有效平行比较。该解决方案在所有缓存级别上都起作用，并防御在另一个核心，相同核心或另一个超线程上运行的攻击者过程。我们的设计保留了共享缓存的好处：允许进程利用整个缓存执行并保留单个共享代码和数据的副本（数据删除）。我们在GEM5模拟器中的实现表明，该系统能够防御RSA键提取。我们使用SpecCPU2006评估性能，并由于第一次访问延迟为2.17％而观察开销。由于安全上下文簿记而引起的间接费用为0.3％。
Timing side channels have been used to extract cryptographic keys and sensitive documents, even from trusted enclaves. In this paper, we focus on cache side channels created by access to shared code or data in the memory hierarchy. This vulnerability is exploited by several known attacks, e.g, evict+reload for recovering an RSA key and Spectre variants for data leaked due to speculative accesses. The key insight in this paper is the importance of the first access to the shared data after a victim brings the data into the cache. To eliminate the timing side channel, we ensure that the first access by a process to any cache line loaded by another process results in a miss. We accomplish this goal by using a combination of timestamps and a novel hardware design to allow efficient parallel comparisons of the timestamps. The solution works at all the cache levels and defends against an attacker process running on another core, same core, or another hyperthread. Our design retains the benefits of a shared cache: allowing processes to utilize the entire cache for their execution and retaining a single copy of shared code and data (data deduplication). Our implementation in the GEM5 simulator demonstrates that the system is able to defend against RSA key extraction. We evaluate performance using SPECCPU2006 and observe overhead due to first access delay to be 2.17%. The overhead due to the security context bookkeeping is of the order of 0.3%.
