Symbolic path cost analysis for side-channel detection

Symbolic path cost analysis for side-channel detection

“…Work on side-channel detection constitutes a large field of research. Our work extends that of Brennan et al [10] with feasibility analyses, compositional solving, and annotation rules. Our most immediate related work is that of Antopolous et al [7] and of Chen et al [13].…”

Detection and mitigation of JIT-induced side channels

“…Potential side channels include those in execution time, memory usage, size and timings of network packets, and power consumption. Although side-channel vulnerabilities due to hardware (such as vulnerabilities that exploit the cache behavior) have been extensively studied [1, 2, 10, 13, 15-17, 19, 23], software side channels have only recently become an active area of research, including recent results on software side-channel detection [4,8,11,12,18,22,24] and quantification [5,20,21], and Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored.…”

“…Request permissions from permissions@acm.org. ICSE '20 Companion, May 23-29, 2020 my own work on a static analysis framework for detection of software side-channels called CoCo-Channel [8]) and a constraint caching framework to accelerate side-channel quantification called Cashew [9].…”

“…An underlying assumption common in existing software side-channel analysis techniques [4,8,12,18] is that the source code is the only determiner of the side-channel observable. This is not the case.…”

“…I evaluated this technique on three widely used datasets -the Blazer dataset, the Themis dataset, and the DiffFuzz dataset. These datasets have been used in the evaluation of four state-of-theart program analysis tools for side-channel detection [4,8,12,18]. Ultimately, I found that many code variants labeled "safe" are in fact vulnerable to JIT-induced timing side channels.…”