Avoiding timing channels in fixed-priority schedulers

Abstract

A practically feasible modification to fixed-priority schedulers allows to avoid timing channels despite threads having access to precise clocks.This modification is rather simple: we compute at admission time a static predicate that states whether a thread may possibly leak information; if such a thread blocks we switch to the idle thread instead.We describe the modified scheduler, provide a mechanical PVS-based proof of noninterference and show how common admission algorithms can be reused to give real-time guarantees for this modified scheduler. While providing similar isolation guarantees, our approach outperforms timepartitioning schedulers in terms of achieved real-time guarantees.

On confidentiality-preserving real-time locking protocols

“…φ i takes as a parameter the schedule up to time t − 1 to produce the prospective action of τ i for time t. S in turn takes this result to produce the schedule for time t and so on. Figure 1 illustrates this interlaced evaluation for a secure fixed-priority scheduler taken from [13].…”

“…Global resource accesses cannot influence the local execution on a processor. However, a blockingaware schedulability analysis must consider the times when a non-interference secure scheduler prohibits local tasks from running while a higher prioritized task awaits the completion of a remote resource request [13]. MPCP, in contrast to the generalized multiprocessor priority ceiling protocol, executes only the newly spawned jobs on the synchronization processor.…”

“…Of course there are several covert channels due to the variability in execution due to the scheduler (see e.g., Foss et al [12] and Völp et al [13]). In this work we shall ignore these channels in the sense that we prove a conditional statement: if the underlying scheduler is non-interference secure, then downward donation preserves this property and downwarddonating protocols prevent the exploitation of shared resource timing channels.…”

“…We discard non-predictable protocols from our analysis as they are not suited for realtime systems. Non-preemptive protocols, such as the flexible multiprocessor locking protocol (FMLP) [16], require other mechanisms to prevent leakage due to non-preemptive execution [13]. As usual, we assume all resource accesses are coordinated by a single instance of the locking protocol.…”

A Covert Timing Channel via Algorithmic Complexity Attacks: Design and Analysis

“…So Hu et al [17] adds noise to timing sources and event delivery to reduces the bandwidth of covert timing channels. Marcus Völp et al [18] proposed a practically feasible modification to fixed-priority schedulers allows to avoid timing channels despite threads having access to precise clocks.…”