DAWG : A Defense Against Cache Timing Attacks in Speculative Execution Processors Vladimir Kiriansky, Ilia Lebedev, Saman Amarasinghe, Srinivas Devadas, Joel Emer {vlk, ilebedev, saman, devadas, emer}@csail.mit.edu MICRO'18 October 24, 2018 Fukuoka, Japan
Outline • Cache access timing attacks • DAWG protection mechanism: Cache, Core • OS support: System Calls, Resource Management • Performance and security evaluation • Conclusion & Q/A DAWG 2
Trust Boundaries Process OS DAWG 3
Trust Boundaries Sand box Process OS Enclave Hypervisor DAWG 4
Trust Boundaries Sand box Process Process OS OS Enclave Hypervisor DAWG 5
Trust Boundary Crossing APIs / Attack Vectors Sand Legal API box Process Process OS OS Enclave Hypervisor DAWG 6
Trust Boundary Crossing APIs / Attack Vectors Sand Legal API box Illegal Channel Process Process OS OS Enclave Hypervisor DAWG 7
Side Channels and Covert Channels Victim's Attacker's Protection Domain Protection Domain Secret Stolen data data ! ! DAWG 8
Side Channels and Covert Channels Victim's Attacker's Protection Domain Protection Domain Secret Accessor data ⛓ ⛓ ⛓ ⛓ ! • Accessor - Existing code - non-speculative, traditional - Synthesized - Spectre 1.0, 1.1 - unresolved DAWG 9
Side Channels and Covert Channels Victim's Attacker's Protection Domain Protection Domain covert Secret Stolen Accessor Transmitter Receiver channel data data ! ! ⛓ ⛓ ⛓ ⛓ ! ! • Accessor - Existing code - non-speculative, traditional - Synthesized - Spectre 1.0, 1.1 - unresolved DAWG 10
Side Channels and Covert Channels Victim's Attacker's Protection Domain Protection Domain covert Secret Stolen Accessor Transmitter Receiver channel data data ! ! ⛓ ⛓ ⛓ ⛓ ! ! • Accessor - Existing code - non-speculative, traditional - Synthesized - Spectre 1.0, 1.1 - unresolved • Channel = micro-architectural state: cache, TLB, branch predictor state, etc. DAWG 11
Side Channels and Covert Channels Victim's Attacker's blocked Protection Domain Protection Domain channel Secret Stolen Accessor Transmitter Receiver data data ! ! ⛓ ⛓ ⛓ ⛓ ! ! • Accessor - Existing code - non-speculative, traditional - Synthesized - Spectre 1.0, 1.1 - unresolved • Channel = micro-architectural state: cache , TLB, branch predictor state, etc. DAWG 12
Cache Covert Channel Victim's Attacker's cache Protection Domain Protection Domain covert Transmitter Receiver channel ! ! ! DAWG 13
Cache Covert Channel: Shared Cache Ways 2-way Cache Set DAWG 14
Cache Covert Channel: Shared Cache Ways [ Flush+Reload, Evict+Reload, Thrash+Reload] 1. Receiver evicts block A 2-way A Cache Set Flush / Evict / Thrash DAWG 15
Cache Covert Channel: Shared Cache Ways 1. Receiver evicts block A 2-way Cache Set Flush / Evict / Thrash DAWG 16
Cache Covert Channel: Shared Cache Ways 1. Receiver evicts block A Flush / Evict / Thrash 0 1 2. Transmitter sends a 0 or 1 A secret bit via access to A DAWG 17
Cache Covert Channel: Shared Cache Ways 1. Receiver evicts block A Flush / Evict / Thrash 0 1 2. Transmitter sends a 0 or 1 A secret bit via access to A 3. Receiver times access to A A DAWG 18
Cache Covert Channel: Shared Cache Ways 1. Receiver evicts block A Flush / Evict / Thrash 0 1 2. Transmitter sends a 0 or 1 A secret bit via access to A 3. Receiver times access to A A A ! infers secret bit > DAWG 19
Cache Covert Channel Victim Attacker cache covert Receiver Transmitter channel ! ! ! ! ☹ DAWG 20
Block Cache Covert Channel? Victim Attacker Receiver Transmitter ! ! ! DAWG 21
DAWG: Dynamically Allocated Way Guard • Cache Protection Domains • Non-interference by any action: hit / flush / eviction / fill DAWG 22
DAWG: Dynamically Allocated Way Guard • Cache Protection Domains Way-partitioned Cache Set • Non-interference by any action: hit / flush / eviction / fill • Partitioned ways of set-associative structures • Domain-private cache tag state DAWG 23
DAWG: Dynamically Allocated Way Guard • Cache Protection Domains Way-partitioned Cache Set • Non-interference by any action: hit / flush / eviction / fill • Partitioned ways of set-associative structures • Domain-private cache tag state • Domain-private replacement metadata DAWG 24
No Cache Covert Channel: Private Cache Ways Per-Domain Ways Victim Attacker DAWG 25
No Cache Covert Channel: Private Cache Ways 1. Receiver evicts block A? Flush / Evict / Thrash DAWG 26
No Cache Covert Channel: Private Cache Ways 1. Receiver evicts block A Flush / Evict / Thrash DAWG 27
No Cache Covert Channel: Private Cache Ways 1. Receiver evicts block A Flush / Evict / Thrash 0 1 2. Transmitter sends a 0 or 1 A secret bit via access to A DAWG 28
No Cache Covert Channel: Private Cache Ways 1. Receiver evicts block A Flush / Evict / Thrash 0 1 2. Transmitter sends a 0 or 1 A secret bit via access to A 3. Receiver times access to A A DAWG 29
No Cache Covert Channel: Private Cache Ways 1. Receiver evicts block A Flush / Evict / Thrash 0 1 2. Transmitter sends a 0 or 1 A secret bit via access to A 3. Receiver times access to A A A A no signal = DAWG 30
No Cache Covert Channel: Private Cache Ways 1. Receiver evicts block A Flush / Evict / Thrash 0 1 2. Transmitter sends a 0 or 1 A secret bit via access to A 3. Receiver times access to A ?! A A A no signal = DAWG 31
No Cache Covert Channel Victim Attacker Domain Domain ! Transmitter ! Receiver ! DAWG 32
CAT: QoS Cache Partitioning • Starting point in production silicon: Intel's Cache Allocation Technology for LLC • Iyer et al [SC'04, SIGMETRICS'07, MICRO'07 ] From concept to reality in Haswell [HPCA'16] • Not a security barrier Quality of Service goal: prevent one application from dominating the cache DAWG 33
CAT: Way-Partitioned Set-associative Caches • Way-partitioning LLC coherence Cache controller state machine logic replacement way write cache line policy • Protection domain IDs Address enables write data updated set metadata Tag Set Index • Fill mask way set new write index cache enable line cache set W 0 W 1 W 2 ... W 3 metadata cache way Tag Line set metadata == == == == way hits hit DAWG 34 cache line
DAWG: Dynamically Allocated Way Guard • Way-partitioning L1 -L3 coherence policies Cache controller state machine logic replacement fill policy way write cache line • Protection domain IDs isolation Address enables write data updated set metadata Tag • Fill mask Set Index way set new write index cache enable line cache set metadata W 0 W 1 W 2 ... W 3 metadata cache way Tag Line set metadata == == == == policy-masked hit way hits hit isolation DAWG 35 cache line
DAWG: Dynamically Allocated Way Guard • Way-partitioning L1 -L3 coherence policies Cache controller state machine logic replacement fill policy way write cache line • Protection domain IDs isolation Address enables write data updated set metadata Tag • Fill mask Set Index way set new write index cache enable line cache set • Hit mask metadata W 0 W 1 W 2 ... W 3 metadata cache way - Hits Tag Line set metadata == == == == policy-masked hit way hits hit isolation isolation DAWG 36 cache line
DAWG: Dynamically Allocated Way Guard • Way-partitioning L1 -L3 coherence policies Cache controller state machine logic replacement fill policy way write cache line • Protection domain IDs isolation Address enables write data updated set metadata Tag • Fill mask Set Index way set new write index cache enable line cache set • Hit mask metadata W 0 W 1 W 2 ... W 3 metadata cache isolation way - Hits Tag Line set metadata - PLRU updates == == == == policy-masked hit way hits hit isolation isolation DAWG 37 cache line
Higher Security than QoS Cache Partitioning • Production QoS CAT DAWG way-partitioning (CAT) ✅ ✅ Way by design allows allocation hits across domains ❌ ✅ Hits in victim • Not a security barrier Hits Cross-Domain DAWG 38
Higher Security than QoS Cache Partitioning • Production QoS CAT DAWG way-partitioning (CAT) ✅ ✅ Way by design allows allocation hits across domains ❌ ✅ Hits in victim • Not a security barrier ❌ ✅ Flush in victim Flush DAWG 39
Recommend
More recommend
