Abstract:Cache Side-Channel Attacks (CSCAs) have been haunting most processor architectures for decades now. Existing approaches to mitigation of such attacks have certain drawbacks, namely software mishandling, performance overhead, and low throughput due to false alarms. Hence, “mitigation only when detected” should be the approach to minimize the effects of such drawbacks. We propose a novel methodology of fine-grained detection of timing-based CSCA using a hardware-based detection module. We discuss the design, implementation, and use of our proposed detection module in processor architectures. Our approach successfully detects attacks that flush secret victim information from cache memory like Flush+Reload, Flush+Flush, Prime+Probe, Evict+Probe, and Prime+Abort, commonly known as cache timing attacks. Detection is on time with minimal performance overhead. The parameterizable number of counters used in our module allows detection of multiple attacks on multiple sensitive locations simultaneously. The fine-grained nature ensures negligible false alarms, severely reducing the need for any unnecessary mitigation. The proposed work is evaluated by synthesizing the entire detection algorithm as an attack detection block, Edge-CaSCADe, in a RISC-V processor as a target example. The detection results are checked under different workload conditions with respect to the number of attackers and the number of victims having RSA-, AES-, and ECC-based encryption schemes like ECIES, and on benchmark applications like MiBench and Embench. More than 98% detection accuracy within 2% of the beginning of an attack can be achieved with negligible false alarms. The detection module has an area and power overhead of 0.9% to 2% and 1% to 2.1% for the targeted RISC-V processor core without cache for one to five counters, respectively. The detection module does not affect the processor critical path and hence has no impact on its maximum operating frequency.

MCU-Wide Timing Side Channels and Their Detection

Timing Side-Channel Attacks and Countermeasures in CPU Microarchitectures

SoC It to EM: ElectroMagnetic Side-Channel Attacks on a Complex System-on-Chip

Osiris: Automated Discovery of Microarchitectural Side Channels

Prevention of Microarchitectural Covert Channels on an Open-Source 64-bit RISC-V Core

Lightweight Hardware-Based Cache Side-Channel Attack Detection for Edge Devices (Edge-CaSCADe)

Power Side Channels in Security ICs: Hardware Countermeasures

Timing the Transient Execution: A New Side-Channel Attack on Intel CPUs

IChannels: Exploiting Current Management Mechanisms to Create Covert Channels in Modern Processors

Microarchitectural Leakage Templates and Their Application to Cache-Based Side Channels

On Borrowed Time -- Preventing Static Side-Channel Analysis

Side-Channel Information Leakage Analysis And Countermeasures In An Embedded Cpu Microarchitecture

Lightweight Countermeasures Against Static Power Side-Channel Attacks

SoK: Analysis of Root Causes and Defense Strategies for Attacks on Microarchitectural Optimizations

DDM: A Demand-based Dynamic Mitigation for SMT Transient Channels

Timing covert channel analysis of the VxWorks MILS embedded hypervisor under the common criteria security certification

Amplifying Main Memory-Based Timing Covert and Side Channels using Processing-in-Memory Operations

Processor Hardware Security Vulnerabilities and their Detection by Unique Program Execution Checking

Timing Side-Channel Mitigation via Automated Program Repair

Side-Channel Analysis-Based Detection Approach of Hardware Trojans

R-STELLAR: A Resilient Synthesizable Signature Attenuation SCA Protection on AES-256 with built-in Attack-on-Countermeasure Detection