LiD-CAT: A Lightweight Detector for Cache ATtacks

Abstract

Cache attacks are one of the most widespread and dangerous threats to embedded computing systems' security. A promising approach to detect such attacks at runtime is to monitor the System-on-Chip (SoC) behavior. However, designing a secure SoC capable of detecting such attacks is very challenging: the monitors should be lightweight in order to avoid excessive power/energy and area costs and the attack behavior should be clearly known upfront. In this work, we present LiD-CAT, a lightweight and flexible hardware detector that is aware of leakage patterns that can be used by attackers to perform cache based attacks. LiD-CAT is a cache wrapper that implements a set of leakage properties derived from cache attacks and cache models using templates. These templates identify suspicious behavior that may lead to cache attacks. LiD-CAT is evaluated using two different cache architectures, one with a secure cache and one without. On each of them, SPEC2000 benchmarks are run together with malicious applications that execute cache attacks (i.e., Evict+Time, Prime+Probe, Flush+Reload and Flush+Flush). Results show that our lightweight detector successfully detects 99.99% of the attacks with less than 1% false-positives, has no timing penalties, and increases the area of a SoC with only 1.6%.

MATANA: A Reconfigurable Framework for Runtime Attack Detection Based on the Analysis of Microarchitectural Signals

“…However, some less flexible propositions-such as the monitoring of a small amount of selected microarchitectural signals directly in hardware-have been proposed to enforce the security of a specific hardware component. For instance, LiD-CAT [29] monitors cacherelated signals and performs detection with a state machine constructed based on a formal description of cache information leakage attacks.…”

“…A comparison of MATANA with previously presented solutions can be found in Table 1. [15] CTCs detection no event limited no PMUe [16] no ROP detection event no no Wahab et al [19] no DIFT instruction high no Lee et al [20] no ROP detection instruction high no Raksha [21] no DIFT instruction + tag limited no FlexCore [22] no DIFT instruction high no Harmoni [23] no DIFT instruction + tag limited no LBA [24] no DIFT instruction no no PHMon [25] no DIFT instruction limited no REHAD [26] CSCAs detection no instruction high no LiD-CAT [29] CSCAs detection no cache internal no no MATANA unspecific unspecific any high yes…”

MADFAM: MicroArchitectural Data Framework and Methodology

“…To combat these emerging threats, researchers have proposed secure cache schemes [5] [6], trusted execution environments [7] [8], and Hardware Performance Counter (HPC)-based microarchitectural detectors to identify malicious cache access patterns [9] [10] [11] or patterns associated with the critical path to exploit a microarchitectural side channel [12]. Secure cache architectures and trusted execution environments provide fundamental long-term solutions to protect systems against microarchitectural threats.…”

Guard-NoC: A Protection Against Side-Channel Attacks for MPSoCs

“…The industry further advanced this concept by creating secure zones, also known as Trust Execution Environments (TEE), which isolate the sensitive tasks completely; examples are Arm Trust Zone [9], Intel SGX [10], and Sanctum (RISC-V distribution) enclave [11]. Recently, the authors in [12] and [13] have used machine learning techniques trained with high-performance counters to detect a specific set of cache access attacks, while the authors in [14] used attack models to build a lightweight hardware detector. With respect to MPSoC communication, only hardware solutions have been presented.…”