Physical Isolation against cache-based Side-Channel Attacks on NoC-based architectures Maria Méndez Real, Vincent Migliore, Vianney Lapotre, Guy Gogniat Univ. Bretagne Sud, Lab-STICC,
[email protected]
Motivation • •
Cache-based Side-Channel Attacks (SCA) Access-driven attacks • Shared data • Analyzing its own performance • Determining the cache lines or sets accessed by the victim • Deducing sensitive information
Hardware platform is trusted Trusted and untrusted processes executing in parallel Possible attacks - Confidentiality - Integrity - Denial of services
SoA Cache-based SCA countermeasures • SW : - Modifying the implementation of sensitive applications [1] • HW : - Disabling cacheability - Flushing the cache before each context switching [2] - Redesigning caches -> partitioned cache [3] - Two separate virtual worlds on the same processor [4]
Sharing resources –> Vulnerabilities
Physical Isolation for sensitive applications
Implementation through virtual prototyping: OVP-based MPSoCSim • • •
• Physically isolated execution in a secure zone (SZ) -> No resources sharing within the secure zone ! The NoC is considered secure • A set of services for the controller responsible for the dynamic deployment and handling of secure zones: - Monitoring - Resource allocation - SZ management
4*4 NoC -> 60 PE + 1 controller Matrix multiplications Implementation of two different strategies: 1. static optimum secure zone size 2. static limited size 3. dynamic size secure zones
Different compared scenarios: a. Baseline scenario b. One isolated application arriving at the beginning of the execution
c. One isolated application arriving at the middle of the execution d. Several isolated applications (3/5)
Experimental results
Negligible when no load
The dynamic strategy entails the highest overhead on the controller services
The dynamic strategy leverages the performance of non isolated applications
The dynamic strategy achieves the highest resource utilization rate [1] ] J. Blomer and V. Krummel, “Analysis of Countermeasures Against Access Driven Cache Attacks on AES,” Selected Areas in Cryptography, vol. 4876, pp. 96–109, 2007. [2] Guanciale, et al., “Cache Storage Channels: Alias-Driven Attacks and Verified Countermeasures,” in IEEE Symposium on Security and Privacy, 2016. [3] Wang and R. B. Lee, “New Cache Designs for Thwarting Software Cache-based Side Channel Attacks,” in IEEE Symposium on Computer Architecture (ISCA), 2007, pp. 494–505. [4] www.arm.com/products/processors/technologies/trustzone/
