A Survey on Cache Timing Channel Attacks for Multicore Processors

Abstract

Cache timing channel attacks has attained a lot of attention in the last decade. These attacks exploits the timing channel created by the significant time gap between cache and main memory accesses. It has been successfully implemented to leak the secret key of various cryptography algorithms. The latest advancements in cache attacks also exploit other microarchitectural components such as hardware prefetchers, branch predictor, and replacement engine, in addition to the cache memory. Detection of these attacks is a difficult task as the attacker process running in the processor must be detected before significant portion of the attack is complete. The major challenge for mitigation and defense mechanisms against these attacks is maintaining the system performance while disabling or avoiding these attacks. The overhead caused by detection, mitigation and defense mechanism must not be significant to system's performance. This paper discusses the research carried out in three aspects of cache security: cache timing channel attacks, detection techniques of these attacks, and defense mechanisms in details. KeywordsCache security • Cache timing channel attack • Side-channel attack • Covert channel attack • Detection techniques • Defense mechanisms

TPPD: Targeted Pseudo Partitioning based Defence for Cross-Core Covert Channel Attacks

“…In this case, both trojan and spy use the shared LLC to create a timing channel. Cache timing channel attack can be constructed using various attack techniques like Prime+Probe (P+P), Evict+Reload (E+R), Flush+Reload (F+R), and Evict+Time (E+T) [6]. These attack techniques, even though different, follow these basic three steps:…”

“…We propose TPPD to mitigate cross-core CCA. This attack can be based on Prime+Probe [6], Evict+Reload [6], or Evict+Time [6] methods, where spy and trojan processes rely on replacing each other's block to transmit bits. Trojan has a piece of secret information that spy cannot access directly due to underlying system security policies.…”

“…These attacks become more threatening in shared computing environments such as the cloud, where multiple users from different security domains share the underlying LLC. Cache timing channel can be implemented in two forms: Side-Channel Attack(SCA) and Covert Channel Attack(CCA) [6], [7]. The private keys of cryptography algorithms like AES [8], RSA [9], and ECDSA [10] have been the primary target of cache-based SCAs.…”

“…The private keys of cryptography algorithms like AES [8], RSA [9], and ECDSA [10] have been the primary target of cache-based SCAs. In a CCA, two suspicious processes, spy and trojan, communicate covertly by exploiting the cache timing channel [6]. The trojan runs on a different core and knows some secret information that it needs to send to the spy.…”

Evaluation on the Impact of Cache Parameter Selection in Access-Driven Cache Attacks

“…Clearly, the local core cannot directly affect the adjacent core's private cache but can affect both cores' shared cache. It has been demonstrated in numerous works of literature [33,[46][47][48][49] that cross-core attacks can be carried out using the shared cache (usually LLC), but only if the inclusive attribute is maintained between multi-level cache. The local core can evict data from the shared cache.…”