Fight Hardware with Hardware: Systemwide Detection and Mitigation of Side-channel Attacks Using Performance Counters

Abstract

We present a kernel-level infrastructure that allows system-wide detection of malicious applications attempting to exploit cache-based side-channel attacks to break the process confinement enforced by standard operating systems. This infrastructure relies on hardware performance counters to collect information at runtime from all applications running on the machine. High-level detection metrics are derived from these measurements to maximize the likelihood of promptly detecting a malicious application. Our experimental assessment shows that we can catch a large family of side-channel attacks with a significantly reduced overhead. We also discuss countermeasures that can be enacted once a process is suspected of carrying out a side-channel attack to increase the overall tradeoff between the system’s security level and the delivered performance under non-suspected process executions.

Strategies and software support for the management of hardware performance counters

“…Hardware introspection capabilities provided by HPCs are suitable to address multiple security challenges, 46,47 ranging from the identification of return‐oriented programming attacks 48 to the detection of several exploits of side‐channel vulnerabilities 49,50 . Furthermore, the design of countermeasures for new transient execution vulnerabilities 51 present in most processors required new strategies featured by hardware instrumentation 52,53 to observe the stealth activities performed by attackers, also in a system‐wide fashion 4 . All these works highlight the relevance of PMUs as a support for the online profiling of applications.…”

“…Moreover, perf contains an anti‐trashing detector that reduces the profiling frequency rate if the interrupt routine experiences a delay over a defined threshold. However, this mechanism introduces a degree of indeterminism that cannot be easily quantified and that, depending on the objective for which PMU data are used, may be unacceptable—like for the case of security based on the hardware footprint left by the running software 4 …”

“…49,50 Furthermore, the design of countermeasures for new transient execution vulnerabilities 51 present in most processors required new strategies featured by hardware instrumentation 52,53 to observe the stealth activities performed by attackers, also in a system-wide fashion. 4 All these works highlight the relevance of PMUs as a support for the online profiling of applications. Nevertheless, carrying out this kind of activity might incur severe performance penalties.…”

“…While HPCs have been available since very old architectures like Intel Pentium and AMD Athlon, their importance has made them see a considerable expansion over the last decades. In fact, they have been used not only to profile the execution of software in terms of actual hardware reactiveness and achievable performance, 1 or for relating software execution to power and energy consumption, 2,3 but also to support security 4 or specific functional tasks 5 thus offloading them from software modules.…”

“…Furthermore, as we also show in our experimental analysis, they can lose PMU samples under the high frequency of their production, which can be undesirable in specific application contexts, like, for example, PMU exploitation for security. 4 Hence, how to cope with all the aforementioned aspects in the context of online exploitation of HPCs is still an ongoing research activity.…”