1. New Cache Designs for Thwarting Cache-based Side Channel Attacks
Zhenghong Wang and Ruby B. Lee Princeton Architecture Laboratory for Multimedia and Security
Department of Electrical Engineering, Princeton University
Motivation and Goals
Summary of Attacks
Proposed Solutions - RPcache
Performance
Cache-based side channel attacks are a new and more dangerous threat
Easy to launch
Impact a wider range of systems and users
Existing solutions are insufficient
Performance degradation
Attack specific
Some are not secure enough
Goals:
Security without compromising performance and cost
General non-attack-specific solutions
Cache interference enables side channel attacks
External interference: Percival’s attack
Internal interference: Bernstein’s attack
Spectrum of attacks
Random-Permutation cache (RPcache)
Blocks information leak by randomizing cache interference
Advantages
Allow cache line sharing
Negligible performance impact
Provable security
An information-theoretic proof
Low overhead implementation
No impact on cache access time
Partition-Locked cache (PLcache)
Comparable with traditional caches if properly used
Considerable performance impact on direct-mapped caches
The number of locked cache lines should be reasonably small
Random-Permutation cache (RPcache)
Consistently comparable with traditional caches over various cache configurations (less than 2% worst case)
Attacker’s ability in observing victim’s cache accesses
Bernstein’s attack
+ Only aggregated cache behavior is indirectly observable
+ Requires large number of experiments and statistical analysis
Least accurate
Most accurate
Percival’s attack
+ Individual cache access directly observable
+ Key recovery in one single trial
A Logical View of RPcache
Ongoing and Future Work
Attacks
The security-enabling mechanism of RPcache can be exploited to improve:
Performance
Power efficiency
Fault tolerance
Thermal control
and more…
Improved implementation
Percival’s attack against RSA
Bernstein’s attack against AES
Our Approach
Hardware-based approach
New security-aware cache architectures
Provide security with good performance
Attack the root cause of the attacks
Ensure generality
Solutions effective on both known and unknown attacks
RSA Core operation:
x := ad mod p
(d is the secret key)
Implemented as:
Squaring:
x:= x2 mod p
Multiplication:
x:= x·a2k+1 mod p
(2k+1 is a segment of d)
Table Lookup:
a2k+1 is pre-computed and stored in a table
Attack:
Identify table lookup memory accesses
Location of the accessed cache line reveals the key bits 2k+1
Low Overhead Implementation
Summary and Conclusions
Cache-based side channel attacks are a new and more dangerous threat
We proposed new security-aware cache designs that can mitigate existing attacks as well as unknown attacks
The proposed cache designs provide sufficient security with negligible performance degradation and can be implemented with low cost
Proposed Solutions - PLcache
Partition-Locked cache (PLcache)
Blocks information leak by disallowing cache interference
Achieves partitioning via cache line locking
Fine-grained and flexible locking mechanisms
Locking on cacheline-granularity
Locking on page-granularity
Advantages
Only necessary lines are locked
Better cache utilization
More secure than simple static partition
Explicit locking mechanism
Avoids unwanted cache line evictions within a partition
Simple architecture and low cost
Address decoder circuitry of RPcache
Principle: the average encryption time of the AES cipher is dependent on the plaintext byte value and the secret key value
Security Analysis
Plaintext byte value
Average Encryption Time
Known key – byte 0
Unknown key – byte 0
Method: model the side channel as a communication channel
Input alphabet: cacheset# accessed by the victim
Output alphabet: cacheset# on which the attacker observes a miss
Related Publications
[1] Zhenghong Wang and Ruby B. Lee, “New Cache Designs for Thwarting Software Cache-based Side Channel Attacks", Proceedings of the 34th International Symposium on Computer Architecture (ISCA 2007), San Diego, CA, pp , June 2007.
[2] Michael Neve, Jean-Pierre Seifert, and Zhenghong Wang, “A refined look at Bernstein's AES side-channel analysis,” Fast abstract in the Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security, pp. 369, March 2006.
Traditional cache
RPcache
sender
receiver 1 3 2
Time
AES starts
AES ends
Channel capacity determined by
Pr(j|i) = Prob{output=j|input=i}
CapacityRPcache = 0 since all Pr(j|i) are equal