Leveraging Gate-Level Properties to Identify Hardware Timing Channels

Abstract

Abstract-Modern embedded computing systems such as medical devices, airplanes, and automobiles continue to dominate some of the most critical aspects of our lives. In such systems, the movement of information throughout a device must be tightly controlled to prevent violations of privacy or integrity. Unfortunately, bounding the flow of information can often present a significant challenge, as information can flow through channels that are difficult to detect, such as timing channels. As has been demonstrated by recent research in hardware security, information flow tracking techniques deployed at the hardware or gate level show promise at identifying these "timing flows" but provide no formal statements about this claim NOR mechanisms for separating out timing information from other types of flows. In this paper, we first prove that gate-level information flow tracking can in fact detect timing flows. In addition, we work to identify these timing flows separately from other flows by presenting a framework for identifying a different type of flow that we call functional flows. By using this framework to either confirm or rule out the existence of such flows, we leverage the previous work in hardware information flow tracking to effectively isolate timing flows. To show the effectiveness of this model, we demonstrate its usage on three practical examples: a shared bus (I 2 C), a cache in a MIPS-based processor, and an RSA encryption core, all of which were written in Verilog/VHDL and then simulated in a variety of scenarios. In each scenario, we demonstrate how our framework can be used to identify timing and functional flows and also analyze our model's overhead.

Processor Hardware Security Vulnerabilities and their Detection by Unique Program Execution Checking

“…This demands a priori knowledge about possible covert channels. In order to capture and remove timing-based side channels in the design the gate-level netlist can be instrumented with IFT capabilities [15]. Such a gate-level IFT method is meant to be applied to selected modules such as a crypto-core or a bus controller.…”

Understanding and Mitigating Covert Channels Through Branch Predictors

“…As CC-Hunter is based on detecting contention, it is not directly applicable to detecting the covert channels through branch predictors proposed here, as these channels are not created based on contention. Another fundamental approach that builds the system from the ground up to detect the presence of side channels [Domnitser et al 2012], covert channels, and other unintended information flows is gate-level information flow tracking (GLIFT) [Tiwari et al 2009;Oberg et al 2014]. Although shown to be effective, GLIFT requires significant rearchitecting and redesign of the entire system.…”

Gate-Level Information Flow Tracking for Security Lattices

“…By employing a multilevel security lattice, it allows finer classification of data objects and a better understanding of the leakage process. We refer the interested reader to other works that provide more detail on GLIFT for detecting timing channels [Oberg et al 2013a;2014], which is out of the scope of this work.…”

“…Oberg has shown how GLIFT can be used to identify and eliminate timing channels in shared buses architectures such as I2C, USB, and Wishbone [Oberg et al , 2013a. Further, a practical testing framework is constructed to prove strict isolation between IP blocks with different trust basis in SoC (System-on-Chip) systems [Oberg et al 2014]. Again, GLIFT is used to identify and eliminate harmful flows of information, including those through hard-to-detect timing channels.…”