Eliminating cache-based timing attacks with instruction-based - PowerPoint PPT Presentation

Eliminating cache-based timing attacks with instruction-based scheduling Deian Stefan , Pablo Buiras, Edward Z. Yang, Amit Levy, David Terei, Alejandro Russo, and David Mazières

Motivation: IFC Web platforms Platforms allow 3rd-party developers to build apps that use our personal data ➤ Extend the websites beyond original intent!

Motivation: IFC Web platforms Platforms allow 3rd-party developers to build apps that use our personal data ^and sometimes leak ➤ Extend the websites beyond original intent!

Motivation: IFC Web platforms editor ... Challenge: can we ensure address photo apps don’t leak data? book Current approach: DAC Platform ➤ Restrict what data app can access Cannot guarantee what app does with data

Motivation: IFC Web platforms editor ... Challenge: can we ensure address photo apps don’t leak data? book Current approach: DAC Platform ✗ ➤ Restrict what data app can access Cannot guarantee what app does with data

Motivation: IFC Web platforms editor ... Challenge: can we ensure address photo apps don’t leak data? book Current approach: DAC Platform ➤ Restrict what data app can access Cannot guarantee what app does with data

Motivation: IFC Web platforms editor ... Challenge: can we ensure address photo apps don’t leak data? book Current approach: DAC Platform ➤ Restrict what data app can access Cannot guarantee what app does with data

Motivation: IFC Web platforms editor ... Challenge: can we ensure address photo apps don’t leak data? book Current approach: DAC Platform ➤ Restrict what data app can access ✦ All your contacts Cannot guarantee what app does with data

Motivation: IFC Web platforms editor ... Challenge: can we ensure address photo apps don’t leak data? book Name: Joe Smith Nick: Small J Occupation: N/A Current approach: DAC Platform ➤ Restrict what data app can access ✦ All your contacts Cannot guarantee what app does with data

Motivation: IFC Web platforms Name: Jullian Assange Nick: Big J Occupation: make U.S. gov unhappy editor ... Challenge: can we ensure address photo apps don’t leak data? book Name: Joe Smith Nick: Small J Occupation: N/A Current approach: DAC Platform ➤ Restrict what data app can access ✦ All your contacts Cannot guarantee what app does with data

Motivation: IFC Web platforms Name: Jullian Assange Nick: Big J Occupation: make U.S. gov unhappy editor ... Challenge: can we ensure address photo apps don’t leak data? book Name: Joe Smith Nick: Small J Occupation: N/A Current approach: DAC Platform ➤ Restrict what data app can access ✦ All your contacts Cannot guarantee what app does with data

Motivation: IFC Web platforms Solution: Information flow editor ... control Web platform: Hails address photo book Hails IFC enforcement: Hails platform ➤ Restrict what data app can access with clearance ➤ Restrict who app can communicate with depending on data it reads

Motivation: IFC Web platforms Solution: Information flow editor ... control Web platform: Hails address photo book Hails IFC enforcement: Hails platform ➤ Restrict what data app can access with clearance IFC: Can app read sensitive ➤ Restrict who app can data from the database? communicate with depending on data it reads

Motivation: IFC Web platforms Solution: Information flow editor ... control Web platform: Hails address photo book Name: Joe Smith Nick: Small J Occupation: N/A Hails IFC enforcement: Hails platform ➤ Restrict what data app can access with clearance IFC: Can app read sensitive ➤ Restrict who app can data from the database? communicate with depending on data it reads

Motivation: IFC Web platforms Name: Jullian Assange Nick: Big J Occupation: make U.S. gov unhappy Solution: Information flow editor ... control Web platform: Hails address photo book Name: Joe Smith Nick: Small J Occupation: N/A Hails IFC enforcement: Hails platform ➤ Restrict what data app can access with clearance IFC: Can app read sensitive ➤ Restrict who app can data from the database? communicate with depending on data it reads

Motivation: IFC Web platforms Name: Jullian Assange Nick: Big J Occupation: make U.S. gov unhappy Solution: Information flow editor ... control Web platform: Hails address photo book Name: Joe Smith Nick: Small J Occupation: N/A Hails IFC enforcement: Hails platform ➤ Restrict what data app IFC: Can app write can access with clearance sensitive data to nsa.gov? IFC: Can app read sensitive ➤ Restrict who app can data from the database? communicate with depending on data it reads

Motivation: IFC Web platforms Name: Jullian Assange Nick: Big J ✗ Occupation: make U.S. gov unhappy Solution: Information flow editor ... control Web platform: Hails address photo book Name: Joe Smith Nick: Small J Occupation: N/A Hails IFC enforcement: Hails platform ➤ Restrict what data app IFC: Can app write can access with clearance sensitive data to nsa.gov? IFC: Can app read sensitive ➤ Restrict who app can data from the database? communicate with depending on data it reads

Hails Web-platform framework wiki.gitstar.com • Hails is built atop the LIO learnbyhacking.org Hails framework www.gitstar.com ➤ Concurrent, dynamic, Hails framework ≀≀ ≀ LIO IFC system ≀ language-level IFC system Hails framework ≀≀ ≀ LIO IFC system ≀ GHC Haskell Runtime ≀≀ ≀ LIO IFC system ≀ • Hails apps are LIO programs GHC Haskell Runtime GHC Haskell Runtime ➤ Access database, filesystem, network, etc. according to IFC

Challenge: covert channels • Malicious apps will try to leak data through any means, including covert channels ➤ E.g., termination, internal timing, and external timing channels • LIO addresses these channels at the language level Theorem: Termination-sensitive non-interference ➤ Confidentiality and integrity of data is preserved regardless of the timing/termination behavior of threads

Challenge: covert channels • Malicious apps will try to leak data through any means, including covert channels ➤ E.g., termination, internal timing, and external timing channels ✗ • LIO addresses these channels at the language level Theorem: Termination-sensitive non-interference ➤ Confidentiality and integrity of data is preserved regardless of the timing/termination behavior of threads

Reality check Cache Rules Everything Around Me • Not modeling hardware features ➠ theorem only holds for ideal execution machine • Can usually exploit system by leveraging features not captured by model ➤ E.g., finite memory, disk-head location, CPU- bus, translation look-aside buffer, L1-L3 caches Focus: hardware-level caches

Cache-based attack Cache lowArray := fillArray( ) if friend == “Julian Assange” highArray := fillArray( ) Thread A Thread B readArray(lowArray) for 1..3 do skip output output := A 1: 2: output := B

Cache-based attack Cache lowArray := fillArray( ) Run 1 if friend == “Julian Assange” highArray := fillArray( ) Thread A Thread B readArray(lowArray) for 1..3 do skip output 1: 2:

Cache-based attack Cache lowArray := fillArray( ) Run 1 if friend == “Julian Assange” highArray := fillArray( ) Thread A Thread B readArray(lowArray) for 1..3 do skip output 1: 2:

Cache-based attack Cache lowArray := fillArray( ) Run 1 if friend == “Julian Assange” highArray := fillArray( ) Thread A Thread B readArray(lowArray) for 1..3 do skip output 1: A output := A 2:

Cache-based attack Cache lowArray := fillArray( ) Run 1 if friend == “Julian Assange” highArray := fillArray( ) Thread A Thread B readArray(lowArray) for 1..3 do skip output 1: A output := A 2:

Cache-based attack Cache lowArray := fillArray( ) Run 1 if friend == “Julian Assange” highArray := fillArray( ) Thread A Thread B readArray(lowArray) for 1..3 do skip output 1: A output := A 2:

Cache-based attack Cache lowArray := fillArray( ) Run 1 if friend == “Julian Assange” highArray := fillArray( ) Thread A Thread B readArray(lowArray) for 1..3 do skip output 1: B A output := A 2: output := B

Cache-based attack Cache lowArray := fillArray( ) Run 2 if friend == “Julian Assange” highArray := fillArray( ) Thread A Thread B readArray(lowArray) for 1..3 do skip output 1: B A output := A 2:

Cache-based attack Cache lowArray := fillArray( ) Run 2 if friend == “Julian Assange” highArray := fillArray( ) Thread A Thread B readArray(lowArray) for 1..3 do skip output 1: B A output := A 2: B output := B

Cache-based attack Cache lowArray := fillArray( ) Run 2 if friend == “Julian Assange” highArray := fillArray( ) Thread A Thread B readArray(lowArray) for 1..3 do skip output 1: B A output := A 2: A B output := B output := A

Cache-based attack Cache lowArray := fillArray( ) Run 2 if friend == “Julian Assange” highArray := fillArray( ) Thread A Thread B readArray(lowArray) for 1..3 do skip output 1: B A output := A 2: A B output := B Directly encodes / . output := A