Abstract:Cryptographic devices are vulnerable to side-channel attacks, which have attracted broad attention in the hardware security field. The side-channel analysis framework proposed at Eurocrypt 2009 has been widely adopted in academia, containing key elements such as points of interest, leakage models, distinguishers, and security metrics. This classical framework, however, is not intuitively compatible with recent micro-architectural attacks such as cache attacks, therefore, few attempts have been made to link them. In this paper, we extend the classical side-channel analysis framework and migrate its ideas to access-driven cache attacks. We find that cache attacks can be effectively incorporated into this framework. Specifically, we propose a leakage model called cache access pattern vector according to the cache timing leakage characteristics. Furthermore, we propose data preprocessing schemes such as noise reduction, dimensionality reduction, and vector expansion to implement efficient attacks. Subsequently, we proposed seven distinguishers in three categories: difference of means-based analysis, vector distance-based analysis, and mutual information-based analysis. Moreover, we attacked the last round of the AES fast software implementation algorithm based on the Chipyard platform. According to the experimental results, all proposed methods can successfully extract the key, and five of them are comparable to mainstream cache analysis in attack efficiency. Finally, we evaluate the five efficient distinguishers under three different cache micro-architectures using guessing entropy. Based on the experimental environment of this paper, vector distance-based distinguishers have the best attack efficiency, and the difference of mean-based analysis has the worst. Surprisingly, the most general mutual information-based attacks can achieve excellent medium results in a few attack rounds without the help of static analysis tools. Meanwhile, the experimental results demonstrate that cache micro-architecture directly impacts the attack effect, in which the smaller cache line size benefits the attacks, while the random replacement policy increases the noise and difficulty of the attacks.

Seeds of SEED: H 2 Cache: Building a Hybrid Randomized Cache Hierarchy for Mitigating Cache Side-Channel Attacks

HybCache: Hybrid Side-Channel-Resilient Caches for Trusted Execution Environments

2C: A New Approach to Design the Second Level Buffer Cache

Randomizing Set-Associative Caches Against Conflict-Based Cache Side-Channel Attacks

SEA Cache: A Performance-Efficient Countermeasure for Contention-based Attacks

BackCache: Mitigating Contention-Based Cache Timing Attacks by Hiding Cache Line Evictions

Chunked-Cache: On-Demand and Scalable Cache Isolation for Security Architectures

Protecting Cache States Against Both Speculative Execution Attacks and Side-channel Attacks

EBCache: A Novel Cache-Based Mechanism for Mitigating the Spectre Attacks for RISC-V Processor

ClepsydraCache -- Preventing Cache Attacks with Time-Based Evictions

Janus: An Uncertain Cache Architecture to Cope with Side Channel Attacks

Towards A Metrics Suite for Evaluating Cache Side-Channel Vulnerability: Case Studies on An Open-Source RISC-V Processor

Cache Bandwidth Contention Leaks Secrets

RECAST: Mitigating Conflict-Based Cache Attacks Through Fine-Grained Dynamic Mapping

Low power cache architecture with security mechanism

Seeds of SEED: A Side-Channel Resilient Cache Skewed by a Linear Function over a Galois Field

A Hybrid Approach to Cache Management in Heterogeneous CPU-FPGA Platforms.

MeshUp: Stateless Cache Side-channel Attack on CPU Mesh

Fast Modeling L2 Cache Reuse Distance Histograms Using Combined Locality Information from Software Traces

Extending the classical side-channel analysis framework to access-driven cache attacks

TreasureCache: Hiding Cache Evictions Against Side-Channel Attacks