CaSA: End-to-end quantitative security analysis of randomly mapped caches
© 2020 IEEE. It is well known that there are micro-architectural vulnerabilities that enable an attacker to use caches to exfiltrate secrets from a victim. These vulnerabilities exploit the fact that the attacker can detect cache lines that were accessed by the victim. Therefore, architects have loo...
| Main Authors: | , , , , , |
|---|---|
| Other Authors: | |
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2021
|
| Online Access: | https://hdl.handle.net/1721.1/137794 |
| _version_ | 1826215126698557440 |
|---|---|
| author | Bourgeat, T Drean, J Yang, Y Tsai, L Emer, J Yan, M |
| author2 | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory |
| author_facet | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Bourgeat, T Drean, J Yang, Y Tsai, L Emer, J Yan, M |
| author_sort | Bourgeat, T |
| collection | MIT |
| description | © 2020 IEEE. It is well known that there are micro-architectural vulnerabilities that enable an attacker to use caches to exfiltrate secrets from a victim. These vulnerabilities exploit the fact that the attacker can detect cache lines that were accessed by the victim. Therefore, architects have looked at different forms of randomization to thwart the attacker's ability to communicate using the cache. The security analysis of those randomly mapped caches is based upon the increased difficulty for the attacker to determine the addresses that touch the same cache line that the victim has accessedIn this paper, we show that the analyses used to evaluate those schemes were incomplete in various ways. For example, they were incomplete because they only focused on one of the steps used in the exfiltration of secrets. Specifically, the step that the attacker uses to determine the set of addresses that can monitor the cache lines used by the transmitter address. Instead, we broaden the analysis of micro-architecture side channels by providing an overall view of the communication process. This allows us to identify the existence of other communication steps that can also affect the security of randomly mapped caches, but have been ignored by prior workWe design an analysis framework, CaSA, to comprehensively and quantitatively analyze the security of these randomly mapped caches. We comprehensively consider the end-to-end communication steps and study the statistical relationship between different steps. In addition, to perform quantitative analysis, we leverage the concepts from the field of telecommunications to formulate the security analysis into a statistical problem. We use CaSA to evaluate a wide range of attack strategies and cache configurations. Our result shows that the randomization mechanisms used in the state-of-the-art randomly mapped caches are insecure. |
| first_indexed | 2024-09-23T16:16:59Z |
| format | Article |
| id | mit-1721.1/137794 |
| institution | Massachusetts Institute of Technology |
| language | English |
| last_indexed | 2024-09-23T16:16:59Z |
| publishDate | 2021 |
| publisher | IEEE |
| record_format | dspace |
| spelling | mit-1721.1/1377942023-01-17T20:36:18Z CaSA: End-to-end quantitative security analysis of randomly mapped caches Bourgeat, T Drean, J Yang, Y Tsai, L Emer, J Yan, M Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory © 2020 IEEE. It is well known that there are micro-architectural vulnerabilities that enable an attacker to use caches to exfiltrate secrets from a victim. These vulnerabilities exploit the fact that the attacker can detect cache lines that were accessed by the victim. Therefore, architects have looked at different forms of randomization to thwart the attacker's ability to communicate using the cache. The security analysis of those randomly mapped caches is based upon the increased difficulty for the attacker to determine the addresses that touch the same cache line that the victim has accessedIn this paper, we show that the analyses used to evaluate those schemes were incomplete in various ways. For example, they were incomplete because they only focused on one of the steps used in the exfiltration of secrets. Specifically, the step that the attacker uses to determine the set of addresses that can monitor the cache lines used by the transmitter address. Instead, we broaden the analysis of micro-architecture side channels by providing an overall view of the communication process. This allows us to identify the existence of other communication steps that can also affect the security of randomly mapped caches, but have been ignored by prior workWe design an analysis framework, CaSA, to comprehensively and quantitatively analyze the security of these randomly mapped caches. We comprehensively consider the end-to-end communication steps and study the statistical relationship between different steps. In addition, to perform quantitative analysis, we leverage the concepts from the field of telecommunications to formulate the security analysis into a statistical problem. We use CaSA to evaluate a wide range of attack strategies and cache configurations. Our result shows that the randomization mechanisms used in the state-of-the-art randomly mapped caches are insecure. 2021-11-08T19:29:00Z 2021-11-08T19:29:00Z 2020 2021-01-25T19:25:46Z Article http://purl.org/eprint/type/ConferencePaper https://hdl.handle.net/1721.1/137794 Bourgeat, T, Drean, J, Yang, Y, Tsai, L, Emer, J et al. 2020. "CaSA: End-to-end quantitative security analysis of randomly mapped caches." Proceedings of the Annual International Symposium on Microarchitecture, MICRO, 2020-October. en 10.1109/MICRO50266.2020.00092 Proceedings of the Annual International Symposium on Microarchitecture, MICRO Creative Commons Attribution-Noncommercial-Share Alike http://creativecommons.org/licenses/by-nc-sa/4.0/ application/pdf IEEE MIT web domain |
| spellingShingle | Bourgeat, T Drean, J Yang, Y Tsai, L Emer, J Yan, M CaSA: End-to-end quantitative security analysis of randomly mapped caches |
| title | CaSA: End-to-end quantitative security analysis of randomly mapped caches |
| title_full | CaSA: End-to-end quantitative security analysis of randomly mapped caches |
| title_fullStr | CaSA: End-to-end quantitative security analysis of randomly mapped caches |
| title_full_unstemmed | CaSA: End-to-end quantitative security analysis of randomly mapped caches |
| title_short | CaSA: End-to-end quantitative security analysis of randomly mapped caches |
| title_sort | casa end to end quantitative security analysis of randomly mapped caches |
| url | https://hdl.handle.net/1721.1/137794 |
| work_keys_str_mv | AT bourgeatt casaendtoendquantitativesecurityanalysisofrandomlymappedcaches AT dreanj casaendtoendquantitativesecurityanalysisofrandomlymappedcaches AT yangy casaendtoendquantitativesecurityanalysisofrandomlymappedcaches AT tsail casaendtoendquantitativesecurityanalysisofrandomlymappedcaches AT emerj casaendtoendquantitativesecurityanalysisofrandomlymappedcaches AT yanm casaendtoendquantitativesecurityanalysisofrandomlymappedcaches |