Autonomous detection of cache-based side-channel attacks

Patent metadata

Field	Value
Publication number	US-11775635-B2
Application number	US-202016826319-A
Country	US
Kind code	B2
Filing date	Mar 23, 2020
Priority date	Dec 23, 2019
Publication date	Oct 3, 2023
Grant date	Oct 3, 2023

Abstract

A method for detecting a cache-based side-channel attack includes utilizing a timer thread that continuously increments a variable in code of an application. The code has been instrumented such that the instrumented code uses the variable incremented by the timer thread to infer an amount of time taken for running a part of the code. A number of cache misses during execution of the part of the code is determined based on the amount of time. It is determined whether the application is experiencing the cache-based side-channel attack using a classifier which uses as input the number of cache misses.

First claim

What is claimed is:

1. A method for detecting a cache-based side-channel attack, the method comprising:
utilizing a timer thread that continuously increments a variable in code of an application that has been instrumented such that the instrumented code uses the variable incremented by the timer thread to infer an amount of time taken for running a part of the code;
determining a number of cache misses during execution of the part of the code based on the amount of time; and
determining whether the application is experiencing the cache-based side-channel attack using a classifier which uses as input the number of cache misses.

2. The method according to claim 1 , wherein the number of cache misses is determined by comparing the amount of time to a threshold.

3. The method according to claim 1 , wherein the application runs in a trusted execution environment implemented on a host machine that also runs a further application outside of the trusted execution environment, the application and the further application running on different cores of the host machine and sharing last-level cache.

4. The method according to claim 1 , wherein the timer thread is implemented separately from a main thread of the application.

5. The method according to claim 4 , wherein the timer thread is implemented in a same trusted execution environment as the application.

6. The method according to claim 4 , wherein the application runs in a trusted execution environment, and wherein the timer thread is implemented outside of the trusted execution environment and on a different core of a same host machine on which the application runs than the trusted execution environment.

7. The method according to claim 1 , wherein the classifier is trained by running applications in a controlled environment with different cache configurations and/or while running a cache-based side-channel attack, collecting a number of cache misses during execution, and using the number of cache misses to generate a classification model used by the classifier.

8. The method according to claim 1 , further comprising aborting execution of the application based on the classifier determining the application is experiencing the cache-based side-channel attack.

9. The method according to claim 1 , wherein the timer thread is not a service provided by an operating system running the application.

10. The method according to claim 1 , wherein the instrumented code of the application is instrumented to access a computer register containing a current value of the variable at least twice during execution of the part of the code to infer the amount of time taken for running the part of the code.

11. The method according to claim 10 , wherein the instrumented code of the application is instrumented to access the computer register before and after each memory access instruction, and wherein the number of cache misses is determined based on a total number of times during execution of the part of the code that a time elapsed for one of the memory access instructions exceeds a threshold.

12. The method according to claim 10 , wherein the instrumented code of the application is instrumented to perform a conditional jump and to access the computer register before and after the conditional jump.

13. A system comprising one or more processors which, alone or in combination, are configured to provide for execution of a method comprising:
utilizing a timer thread that continuously increments a variable in code of an application that has been instrumented such that the instrumented code uses the variable incremented by the timer thread to infer an amount of time taken for running a part of the code;
determining a number of cache misses during execution of the part of the code based on the amount of time; and
determining whether the application is experiencing the cache-based side-channel attack using a classifier which uses as input the number of cache misses.

14. The system according to claim 13 , wherein the application runs in a trusted execution environment implemented on a host machine that also runs a further application outside of the trusted execution environment, the application and the further application running on different cores of the host machine and sharing last-level cache.

15. A tangible, non-transitory computer-readable medium having instructions thereon which, upon being executed by one or more processors, alone or in combination, provide for execution of a method comprising:
utilizing a timer thread that continuously increments a variable in code of an application that has been instrumented such that the instrumented code uses the variable incremented by the timer thread to infer an amount of time taken for running a part of the code;
determining a number of cache misses during execution of the part of the code based on the amount of time; and
determining whether the application is experiencing the cache-based side-channel attack using a classifier which uses as input the number of cache misses.

16. The method according to claim 1 , wherein the variable is shared with a main thread of the application, the main thread including the instrumented code which is instrumented to access a computer register containing a current value of the variable at least twice during execution of the part of the code to infer the amount of time taken for running the part of the code.

17. The method according to claim 16 , wherein the main thread of the application is running in a trusted execution environment, and wherein the timer thread is running in the same trusted execution environment or on a different core of a same host machine that runs the application than the trusted execution environment.

18. The method according to claim 17 , wherein the timer thread does not use a timer or counter service provided by an operating system of the host machine.

19. The method according to claim 17 , wherein an additional application is running in a separate trusted execution environment on the same host machine that runs the application, and wherein the variable is shared by the main thread of the application and a main thread of the additional application.

20. The method according to claim 1 , wherein the timer thread increments the variable using a busy loop.

Assignees

• NEC Laboratories Europe GmbH
• Nec Corp

Inventors

• Jiang Jianyu
• Karame Ghassan
• Soriente Claudio

Classifications

• G06F21/554 Primary

  involving event detection and direct action · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06N5/04

  Inference or reasoning models · CPC title

• G06N20/00

  Machine learning · CPC title

• G06F2221/034

  Test or assess a computer or a system · CPC title