C5: Cross-Cores Cache Covert Channel

Maurice, Clémentine; Neumann, Christoph; Heen, Olivier; Francillon, Aurélien

doi:10.1007/978-3-319-20550-2_3

Cited by 94 publications

(62 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To obtain and verify cache miss rate and dTLB miss rate, some cache-based side channel attacks have been implemented here [4,11,12]. As a comparison, a side channel attack rsa_time_attack by Paul Cristian Pintilie, a normal attack web_timing_attack by Daniel Honig, and two benign processes are selected.…”

Section: Characteristics Analysismentioning

confidence: 99%

Detection of Cache-based Side Channel Attack Based on Performance Counters

Peng¹,

Zhou²,

Zhao³

2018

dtcse

View full text Add to dashboard Cite

Abstract. Side channel attack is typically used to get private key of cryptography system. It is one type of great threats to the cryptosystem. How to detect the attack effectively is an open problem. We proposed a way to detect the cache-based side channel attack using performance counters in this paper. Two main performance parameters, i.e. cache miss rate and dTLB miss rate are used here. The result showed that the cache-based side channel attack not only has a high cache miss rate even above 99.4%, but also has a low dTLB miss rate even below 0.002%. The experiments prove that this method can detect cache-based side channel attack accurately and quickly.

show abstract

Section: Characteristics Analysismentioning

confidence: 99%

Detection of Cache-based Side Channel Attack Based on Performance Counters

Peng¹,

Zhou²,

Zhao³

2018

dtcse

View full text Add to dashboard Cite

show abstract

“…The authors then change the protocol for better error handling effectively lowering the data transmission rate to about 110 bps but an improved error rate of 0.75%. Maurice et al [28] again target the shared last level cache, but address the uncertainty of which cache lines the cooperating parties should transmit upon using inclusiveness. In doing so, they achieve a bit rate of 751 bps in a virtualized environment.…”

Section: B Covert Communication Channelsmentioning

confidence: 99%

“…These attacks occur when two cooperating, but isolated, parties communicate with one another. Often covert channels are used to extract information, but can also be effective in determining multi-tenancy [14], [39], [28], [38], [36].…”

Section: Introductionmentioning

confidence: 99%

“…We show that it is capable of detecting multi-tenancy with equivalent success rate to other cross core multi-tenant detection schemes at comparable cost. Using two [4] BTB N/L 21% Hunger et al [24] BPU 100 kbps 45.2% Xu et al [39] LL Cache 3.2 bps 9.3% Ristenpart et al [34] L2 Cache 0.2 bps N/L Wu et al [38] LL Cache 346 bps ‡ 0.39% ‡ Maurice et al [28] LL Cache 751 bps 5.7%…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Microarchitectural Minefields: 4K-Aliasing Covert Channel and Multi-Tenant Detection in Iaas Clouds

Sullivan¹,

Arias²,

Meade³

et al. 2018

Proceedings 2018 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

We introduce a new microarchitectural timing covert channel using the processor memory order buffer (MOB). Specifically, we show how an adversary can infer the state of a spy process on the Intel 64 and IA-32 architectures when predicting dependent loads through the store buffer, called 4K-aliasing. The 4K-aliasing event is a side-effect of memory disambiguation misprediction while handling write-after-read data hazards wherein the lower 12-bits of a load address will falsely match with store addresses resident in the MOB.In this work, we extensively analyze 4K-aliasing and demonstrate a new timing channel measureable across processes when executed as hyperthreads. We then use 4K-aliasing to build a robust covert communication channel on both the Amazon EC2 and Google Compute Engine capable of communicating at speeds of 1.28 Mbps and 1.49 Mbps, respectively. In addition, we show that 4K-aliasing can also be used to reliably detect multi-tenancy.

show abstract

“…Therefore, the feasibility of this attack is decreased since how to overcome addressing uncertainty is still an open research question. Recently, 2 high-bandwidth CCs have been proposed by Clémentine et al 36 and Liu et al, 5 which use the LLC to tackle the problem of addressing uncertainty and core migration. Both channels are based on the Prime+Probe strategy and rely on the inclusive property of the LLC, which means that the LLC is a superset of the L1 and L2 caches and every cache line that is evicted from the LLC gets removed from the L1 and L2 caches likewise.…”

Section: Central Processing Unitmentioning

confidence: 99%

Survey on covert channels in virtual machines and cloud computing

Betz

Westhoff

Müller

2016

Trans. Emerging Tel. Tech.

View full text Add to dashboard Cite

Covert channels have been known for a long time because of their versatile forms of appearance. For nearly every technical improvement or change in technology, such channels have been (re‐)created or known methods have been adapted. For example, the introduction of hyperthreading technology has introduced new possibilities for covert communication between malicious processes because they can now share the arithmetic logical unit as well as the L1 and L2 caches, which enable establishing multiple covert channels. Even virtualization, which is known for its isolation of multiple machines, is prone to covert‐ and side‐channel attacks because of the sharing of resources. Therefore, it is not surprising that cloud computing is not immune to this kind of attacks. Moreover, cloud computing with multiple, possibly competing users or customers using the same shared resources may elevate the risk of illegitimate communication. In such a setting, the “air gap” between physical servers and networks disappears, and only the means of isolation and virtual separation serve as a barrier between adversary and victim. In the work at hand, we will provide a survey on vulnerable spots that an adversary could exploit trying to exfiltrate private data from target virtual machines through covert channels in a cloud environment. We will evaluate the feasibility of example attacks and point out proposed mitigation solutions in case they exist.

show abstract

C5: Cross-Cores Cache Covert Channel

Cited by 94 publications

References 19 publications

Detection of Cache-based Side Channel Attack Based on Performance Counters

Detection of Cache-based Side Channel Attack Based on Performance Counters

Microarchitectural Minefields: 4K-Aliasing Covert Channel and Multi-Tenant Detection in Iaas Clouds

Survey on covert channels in virtual machines and cloud computing

Contact Info

Product

Resources

About