A Library for Removing Cache-Based Attacks in Concurrent Information Flow Systems

Abstract

Abstract. Information-flow control (IFC) is a security mechanism conceived to allow untrusted code to manipulate sensitive data without compromising confidentiality. Unfortunately, untrusted code might exploit some covert channels in order to reveal information. In this paper, we focus on the LIO concurrent IFC system. By leveraging the effects of hardware caches (e.g., the CPU cache), LIO is susceptible to attacks that leak information through the internal timing covert channel. We present a resumption-based approach to address such attacks. Resumptions provide fine-grained control over the interleaving of thread computations at the library level. Specifically, we remove cache-based attacks by enforcing that every thread yield after executing an "instruction," i.e., atomic action. Importantly, our library allows for porting the full LIO libraryour resumption approach handles local state and exceptions, both features present in LIO. To amend for performance degradations due to the library-level thread scheduling, we provides two novel primitives. First, we supply a primitive for securely executing pure code in parallel. Second, we provide developers a primitive for controlling the granularity of "instructions"; this allows developers to adjust the frequency of context switching to suit application demands.

A Library for Removing Cache-Based Attacks in Concurrent Information Flow Systems

“…Our techniques can be adapted to other Haskell-like IFC systems beyond LIO. The library, case study, and details of the proofs can be found at [6].…”

“…6 To consider such computations, we simply extend the definition of Thread with a new constructor: P arallel::pure b → (b → T hread m a) → T hread m a. Here, pure is a monad that characterizes pure expressions, providing the primitive runPure :: pure b → b to obtain the value denoted by the code given as argument.…”

“…For brevity, we omit a full presentation of the syntax and semantics, since we rely on previous results in order to prove the security property of our approach. The interested reader is referred to [6].…”

A verified information-flow architecture

“…We believe that this IFC mechanism could also be enforced using the hardware mechanisms we describe here. A recently proposed technique for instruction-based scheduling [17,88] is aimed at preventing leaks via the internal timing side-channel (e.g., malicious code sharing the same processor inferring secrets through timing variations arising from cache misses). This could probably be adapted to SAFE, and since the SAFE processor is very simple the mitigation could work well [24].…”

A verified information-flow architecture

“…We believe that this IFC mechanism could also be enforced using the hardware mechanisms we describe here. A recently proposed technique for instruction-based scheduling [17,88] is aimed at preventing leaks via the internal timing side-channel (e.g., malicious code sharing the same processor inferring secrets through timing variations arising from cache misses). This could probably be adapted to SAFE, and since the SAFE processor is very simple the mitigation could work well [24].…”