CaSA: End-to-end Quantitative Security Analysis of Randomly Mapped Caches

Abstract

It is well known that there are micro-architectural vulnerabilities that enable an attacker to use caches to exfiltrate secrets from a victim. These vulnerabilities exploit the fact that the attacker can detect cache lines that were accessed by the victim. Therefore, architects have looked at different forms of randomization to thwart the attacker's ability to communicate using the cache. The security analysis of those randomly mapped caches is based upon the increased difficulty for the attacker to determine the addresses that touch the same cache line that the victim has accessed.In this paper, we show that the analyses used to evaluate those schemes were incomplete in various ways. For example, they were incomplete because they only focused on one of the steps used in the exfiltration of secrets. Specifically, the step that the attacker uses to determine the set of addresses that can monitor the cache lines used by the transmitter address. Instead, we broaden the analysis of micro-architecture side channels by providing an overall view of the communication process. This allows us to identify the existence of other communication steps that can also affect the security of randomly mapped caches, but have been ignored by prior work.We design an analysis framework, CaSA, to comprehensively and quantitatively analyze the security of these randomly mapped caches. We comprehensively consider the end-to-end communication steps and study the statistical relationship between different steps. In addition, to perform quantitative analysis, we leverage the concepts from the field of telecommunications to formulate the security analysis into a statistical problem. We use CaSA to evaluate a wide range of attack strategies and cache configurations. Our result shows that the randomization mechanisms used in the state-of-the-art randomly mapped caches are insecure.Index Terms-Micro-architecture side channel, randomly mapped cache, security analysis.

Seeds of SEED: A Side-Channel Resilient Cache Skewed by a Linear Function over a Galois Field

“…However, the adversary can only deduce that some cache line was filled by the victim-the adversary does not learn the corresponding set index within the victim domain. Consider: if the victim had filled data into set 1, then with 1 4 probability the adversary would also observe one miss in the probe step, in way 1. If the victim had filled data into set x then with 1 4 probability the adversary would observe one miss in way x, and similarly a fill into set x + 1 would be observed with 1 4 probability as a miss in way x+1.…”

“…Consider: if the victim had filled data into set 1, then with 1 4 probability the adversary would also observe one miss in the probe step, in way 1. If the victim had filled data into set x then with 1 4 probability the adversary would observe one miss in way x, and similarly a fill into set x + 1 would be observed with 1 4 probability as a miss in way x+1. Therefore, the standard PRIME+PROBE attack within a GALOISCACHE defined over G p n will only tell the adversary whether the victim filled any line, with 1/p n probability.…”

“…Other side-channel resilient cache proposals use randomization [17] or cryptographic hashing [26] to obfuscate address-to-set and/or address-to-way mappings. These schemes may incur little or no performance penalty, yet they often fail to meet their intended security objectives [1,19]. To compensate for these shortcomings and provide convincing security, these caches must be periodically re-keyed, i.e., the set/way mapping must be redrawn to prevent the adversary from reverse engineering any given mapping and then extracting secrets [21,26].…”

“…The many prior works that use randomization or hashing to obfuscate the cache layout are often accompanied by a security analysis based on probabilistic reasoning [1,21,22,26]. By contrast, the security of GALOISCACHE is predicated upon a single discrete mathematical property of the cache layout, and discrete mathematical properties are, in general, easier to scrutinize that probabilistic security models.…”

DAGguise: mitigating memory timing side channels

“…In general, side channel attacks can be viewed via a communication model where there is a transmitter (the victim) that modulates a channel, with that modulation being detected by a receiver (the attacker) [5,14]. When the channel is a cache, the receiver is generally active, i.e., it modulates the channel itself in order to detect a transmission.…”