Transforming Out Timing Leaks, More or Less

Mantel, Heiko; Starostin, Artem

doi:10.1007/978-3-319-24174-6_23

Cited by 30 publications

(29 citation statements)

References 49 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Another concern is their general applicability, given the complexity of modern runtimes. A recent empirical study by Mantel and Starostin [23] investigates performance and security implications of these techniques, but as an initial step in this direction the paper [23] has a number of simplifying assumptions, such as disabled JIT optimizations and non-malicious code.…”

Section: Scheduler-independent Approachesmentioning

confidence: 99%

Compositional Non-interference for Concurrent Programs via Separation and Framing

Karbyshev

Svendsen

Askarov

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Reasoning about information flow in a concurrent setting is notoriously difficult due in part to timing channels that may leak sensitive information. In this paper, we present a compositional and flexible type-and-effect system that guarantees non-interference by disallowing potentially insecure races that can be exploited through internal timing attacks. In contrast to many previous approaches, which disallow all races on public variables, we use an explicit scheduler model to give a more permissive security definition and type system, which allows benign races on public variables. To achieve compositionality, we use the idea of resources from separation logic, both to locally specify and reason about whether accesses may be racy and to bound the security level of data that may be learned through scheduling.

show abstract

Section: Scheduler-independent Approachesmentioning

confidence: 99%

Compositional Non-interference for Concurrent Programs via Separation and Framing

Karbyshev

Svendsen

Askarov

et al. 2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…There are other papers dealing with Information Flow using language based techniques for programs with a notion of time [2,9,16,22] or programs that leak information intentionally [6,13,[19][20][21]24]. Our contribution focuses on the challenges of continuous time and the guarded actions of timed automata.…”

Section: Contributionmentioning

confidence: 99%

Secure Information Release in Timed Automata

Vasilikos

Nielson

2018

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract.One of the key demands of cyberphysical systems is that they meet their safety goals. Timed automata has established itself as a formalism for modeling and analyzing the real-time safety aspects of cyberphysical systems. Increasingly it is also demanded that cyberphysical systems meet a number of security goals for confidentiality and integrity. Notions of security based on Information flow control, such as non-interference, provide strong guarantees that no information is leaked; however, many cyberphysical systems leak intentionally some information in order to achieve their purposes.In this paper, we develop a formal approach of information flow for timed automata that allows intentional information leaks. The security of a timed automaton is then defined using a bisimulation relation that takes account of the non-determinism and the clocks of timed automata. Finally, we define an algorithm that traverses a timed automaton and imposes information flow constraints on it and we prove that our algorithm is sound with respect to our security notion.

show abstract

“…In our experiments, we use the RSA modular exponentiation (modExp) to encrypt or decrypt a message [13] from the benchmark suite introduced in [14] and modular multiplication (mulMod16) from the IDEA cipher [15]. Since these programs originate from practical cryptographic algorithms with different degrees of sophistication, they are meaningful candidates for the evaluations.…”

Section: A Benchmark Programsmentioning

confidence: 99%

CIDPro: Custom Instructions for Dynamic Program Diversification

Pham

Fell

Biswas

et al. 2018

2018 28th International Conference on Field Programmable Logic and Applications (FPL)

View full text Add to dashboard Cite

Timing side-channel attacks pose a major threat to embedded systems due to their ease of accessibility. We propose CIDPro, a framework that relies on dynamic program diversification to mitigate timing side-channel leakage. The proposed framework integrates the widely used LLVM compiler infrastructure and the increasingly popular RISC-V FPGA softprocessor. The compiler automatically generates custom instructions in the security critical segments of the program, and the instructions execute on the RISC-V custom co-processor to produce diversified timing characteristics on each execution instance. CIDPro has been implemented on the Zynq7000 XC7Z020 FPGA device to study the performance overhead and security tradeoffs. Experimental results show that our solution can achieve 80% and 86% timing side-channel capacity reduction for two benchmarks with an acceptable performance overhead compared to existing solutions. In addition, the proposed method incurs only a negligible hardware area overhead of 1% slices of the entire RISC-V system.

show abstract

Transforming Out Timing Leaks, More or Less

Cited by 30 publications

References 49 publications

Compositional Non-interference for Concurrent Programs via Separation and Framing

Compositional Non-interference for Concurrent Programs via Separation and Framing

Secure Information Release in Timed Automata

CIDPro: Custom Instructions for Dynamic Program Diversification

Contact Info

Product

Resources

About