3 research outputs found
Ozone: Efficient Execution with Zero Timing Leakage for Modern Microarchitectures
Time variation during program execution can leak sensitive information. Time
variations due to program control flow and hardware resource contention have
been used to steal encryption keys in cipher implementations such as AES and
RSA. A number of approaches to mitigate timing-based side-channel attacks have
been proposed including cache partitioning, control-flow obfuscation and
injecting timing noise into the outputs of code. While these techniques make
timing-based side-channel attacks more difficult, they do not eliminate the
risks. Prior techniques are either too specific or too expensive, and all leave
remnants of the original timing side channel for later attackers to attempt to
exploit.
In this work, we show that the state-of-the-art techniques in timing
side-channel protection, which limit timing leakage but do not eliminate it,
still have significant vulnerabilities to timing-based side-channel attacks. To
provide a means for total protection from timing-based side-channel attacks, we
develop Ozone, the first zero timing leakage execution resource for a modern
microarchitecture. Code in Ozone execute under a special hardware thread that
gains exclusive access to a single core's resources for a fixed (and limited)
number of cycles during which it cannot be interrupted. Memory access under
Ozone thread execution is limited to a fixed size uncached scratchpad memory,
and all Ozone threads begin execution with a known fixed microarchitectural
state. We evaluate Ozone using a number of security sensitive kernels that have
previously been targets of timing side-channel attacks, and show that Ozone
eliminates timing leakage with minimal performance overhead
Leveraging Processor Features for System Security
Errors in hardware and software lead to vulnerabilities that can be exploited by attackers.
Proposed exploit mitigation techniques can be broadly categorized into two: software-only
techniques and techniques that propose specialized hardware extensions. Software-only
techniques can be implemented on existing hardware, but typically suffer from impractically
high overheads. On the other hand, specialized hardware extensions, while improving
performance, in practice require a long time to be incorporated into production hardware.
In this dissertation, we propose adapting existing processor features to provide novel and
low-overhead security solutions.
In the first part of the dissertation, we show how modern hardware features can be used
to provide efficient memory safety. One component of memory safety that has become
important in recent years is temporal memory safety. Temporal memory safety techniques
are used to detect memory errors such as use-after-free errors. This dissertation proposes a
temporal memory safety technique that takes advantage of pointer authentication hardware
to significantly reduce the memory and runtime overhead of traditional temporal safety
techniques. Providing complete memory safety on resource constrained devices is expensive,
therefore we propose software-based fault isolation (sandboxing) as an efficient alternative
to constrain attackers’ access to code and data in embedded systems. We show how we can
use the memory protection unit (MPU) hardware available in many embedded devices along
with a small trusted runtime to build a low-overhead sandboxing mechanism.
In the second part of the dissertation, we show how hardware performance counters
in modern processors can be used to detect rowhammer attacks. Our technique detects
rowhammer attacks by monitoring for high locality memory accesses out of the last-level
cache using hardware performance counters. The technique accurately detects rowhammer
attacks with a low performance overhead and without requiring hardware modifications.PHDComputer Science & EngineeringUniversity of Michigan, Horace H. Rackham School of Graduate Studieshttps://deepblue.lib.umich.edu/bitstream/2027.42/149852/1/zaweke_1.pd