Abstract:The adoption of processing-in-memory (PiM) architectures has been gaining momentum because they provide high performance and low energy consumption by alleviating the data movement bottleneck. Yet, the security of such architectures has not been thoroughly explored. The adoption of PiM solutions provides a new way to directly access main memory, which malicious user applications can exploit. We show that this new way to access main memory opens opportunities for high-throughput timing attacks that are hard-to-mitigate without significant performance overhead. We introduce IMPACT, a set of high-throughput main memory-based timing attacks that leverage characteristics of PiM architectures to establish covert and side channels. IMPACT enables high-throughput communication and private information leakage by exploiting the shared DRAM row buffer. To achieve high throughput, IMPACT (i) eliminates cache bypassing steps required by processor-centric main memory and cache-based timing attacks and (ii) leverages the intrinsic parallelism of PiM operations. We showcase two applications of IMPACT. First, we build two covert-channel attacks that run on the host CPU and leverage different PiM approaches to gain direct and fast access to main memory and establish high-throughput communication covert channels. Second, we showcase a side-channel attack that leaks private information of concurrently running victim applications that are accelerated with PiM. Our results demonstrate that (i) our covert channels achieve 12.87 Mb/s and 14.16 Mb/s communication throughput, respectively, which is up to 4.91x and 5.41x faster than the state-of-the-art main memory-based covert channels, and (ii) our side-channel attack allows the attacker to leak secrets with a low error rate. To avoid such covert and side channels in emerging PiM systems, we propose and evaluate three defenses.

Door Knock: Reverse Engineering the MPSoC Layout Through Timing Attack on NoC

SoC It to EM: ElectroMagnetic Side-Channel Attacks on a Complex System-on-Chip

TimingCamouflage+: Netlist Security Enhancement with Unconventional Timing (with Appendix)

DRAMA: Exploiting DRAM Addressing for Cross-CPU Attacks

Security Measures Against a Rogue Network-on-Chip

TROP: TRust-aware OPportunistic Routing in NoC with Hardware Trojans

Amplifying Main Memory-Based Timing Covert and Side Channels using Processing-in-Memory Operations

Multicore DRAM Bank-& Row-Conflict Bomb for Timing Attacks in Mixed-Criticality Systems

RandOhm: Mitigating Impedance Side-channel Attacks using Randomized Circuit Configurations

REPQC: Reverse Engineering and Backdooring Hardware Accelerators for Post-quantum Cryptography

A Pragmatic Methodology for Blind Hardware Trojan Insertion in Finalized Layouts

A Survey of Network-on-Chip Security Attacks and Countermeasures

A Look at the Dark Side of Hardware Reverse Engineering -- A Case Study

MeshUp: Stateless Cache Side-channel Attack on CPU Mesh

TimingSAT: Decamouflaging Timing-based Logic Obfuscation

EOP: An Encryption-Obfuscation Solution for Protecting PCBs Against Tampering and Reverse Engineering

Reverse engineering attack on minterm-camouflaged circuit

Electromagnetic fault injection against a System-on-Chip, toward new micro-architectural fault models

Modeling and Exploration of Gain Competition Attacks in Optical Network-on-Chip Architectures

Coherence Attacks and Countermeasures in Interposer-Based Systems

TPPD: Targeted Pseudo Partitioning based Defence for Cross-Core Covert Channel Attacks