The security risks of power measurements in multicores

Abstract

Two of the main goals of power management in modern multicore processors are reducing the average power dissipation and delivering the maximum performance up to the physical limits of the system, when demanded. To achieve these goals, hardware manufacturers and operating system providers include sophisticated power and performance management systems, which require detailed information about the current processor state. For example, Intel processors offer the possibility to measure the power dissipation of the processor. In this work, we are evaluating whether such power measurements can be used to establish a covert channel between two isolated applications on the same system; the power covert channel.We present a detailed theoretical and experimental evaluation of the power covert channel on two platforms based on Intel processors. Our theoretical analysis is based on detailed modelling and allows us to derive a channel capacity bound for each platform. Moreover, we conduct an extensive experimental study under controlled, yet realistic, conditions. Our study shows, that the platform dependent channel capacities are in the order of 2000 bps and that it is possible to achieve throughputs of up to 1000 bps with a bit error probability of less than 15%, using a simple implementation. This illustrates the potential of leaking sensitive information and breaking a systems security framework using a covert channel based on power measurements. CCS CONCEPTS• Security and privacy → Security in hardware; Operating systems security; KEYWORDS covert channel; power; capacity bound; empirical study ACM Reference Format:

Increased reproducibility and comparability of data leak evaluations using ExOT

“…However, the framework provides two readyto-use models, which can be applied and determine the experimentation flow. The formal models that are implemented and described in ExOT are (i) time-continuous and value-continuous (e. g. thermal [3]), as well as (ii) time-discrete and valuediscrete (e. g. power [10]). One of these two models applies to most covert and side channels.…”

“…Hence, capacity bounds are expressive regarding the general threat potential of a data leak, rather than a specific implementation. Examples for capacity bound derivations can be found in related work [3,4,10,12].…”

“…Considering this observation and due to the fact that no models of cache covert channels were given in the original work, we establish a channel model based on a state machine with two states and all possible transitions. We use the method presented by Miedl and Thiele [10] to determine the maximum capacity of 1 bit per channel use. To get a comparable metric, we need to determine the duration of one channel use.…”