On the capacity of thermal covert channels in multicores

Abstract

Modern multicore processors feature easily accessible temperature sensors that provide useful information for dynamic thermal management. These sensors were recently shown to be a potential security threat, since otherwise isolated applications can exploit them to establish a thermal covert channel and leak restricted information. Previous research showed experiments that document the feasibility of (lowrate) communication over this channel, but did not further analyze its fundamental characteristics. For this reason, the important questions of quantifying the channel capacity and achievable rates remain unanswered. To address these questions, we devise and exploit a new methodology that leverages both theoretical results from information theory and experimental data to study these thermal covert channels on modern multicores. We use spectral techniques to analyze data from two representative platforms and estimate the capacity of the channels from a source application to temperature sensors on the same or different cores. We estimate the capacity to be in the order of 300 bits per second (bps) for the same-core channel, i.e., when reading the temperature on the same core where the source application runs, and in the order of 50 bps for the 1-hop channel, i.e., when reading the temperature of the core physically next to the one where the source application runs. Moreover, we show a communication scheme that achieves rates of more than 45 bps on the same-core channel and more than 5 bps on the 1-hop channel, with less than 1% error probability. The highest rate shown in previous work was 1.33 bps on the 1hop channel with 11% error probability.

The security risks of power measurements in multicores

“…Our experiments show that compared similar cover channels, like the thermal covert channel [2], the power covert channel channel allows a higher throughput but is less robust to disturbances by other applications on the platform.…”

“…In a similar work, Masti et al [10] showed the possibility of such a temperature based covert channel within a processor, to establish a data transmission between different application which are run sequentially on the same core or between two different cores in a multicore system. Bartolini et al [2] later analysed these covert channels between multiple cores in a processor in detail. The authors derived capacity bounds for the different inter-core channels in the order of 300 bits per second (bps) and presented an improved implementation of the covert channel that achieved a throughput of up to 50 bps with less than 1% error probability.…”

“…The authors derived capacity bounds for the different inter-core channels in the order of 300 bits per second (bps) and presented an improved implementation of the covert channel that achieved a throughput of up to 50 bps with less than 1% error probability. Similar to Bartolini et al [2], we will also use a processor parameter to establish a covert channel that allows applications on the same device to communicate and therefore violate the security paradigms enforced by the OS.…”

ExSpectre: Hiding Malware in Speculative Execution

“…Previous work has examined how to share information over covert channels, such as across virtualized environments on cloud systems [59], using L1 and L2 cache to share information [44], measuring temperature to create a thermal covert channel [35], [5], and taking advantage of processor architecture to leak information [57]. This includes using the branch predictor itself as a covert channel [15], [13], which ExSpectre similarly uses.…”

Reduced Cooling Redundancy: A New Security Vulnerability in a Hot Data Center

“…Hasan et al [26] conducted a heat based attack on Simultaneous Multithreading (SMT) by repeatedly accessing a shared source to create a hotspot in one malicious thread. Thermal covert channel attacks based on CPU cores' temperature variations have been presented in [39], [16]. While these works provide a guidance on thermal attacks on individual components, they do not study the impacts of thermal attacks on servers and data centers.…”