An Effective and Scalable VM Migration Strategy to Mitigate Cross-VM Side-Channel Attacks in Cloud

Co-residency of virtual machines(VMs) of different tenants on the same physical platform would possibly lead to cross-VM side-channel attacks in the cloud. While most of current countermeasures fail for real or immediate deployment due to their requirement for modification of virtualization structure, we adopt dynamic migration, an inherent mechanism of the cloud platform, as a general defense against this kind of threats. To this end, we first set up a unified practical information leakage model which shows the factors affecting side channels and describes the way they influence the damage due to side-channel attacks. Since migration is adopted to limit the time duration of co-residency, we envision this defense as an optimization problem by setting up an Integer Linear Programming(ILP) to calculate optimal migration strategy, which is intractable due to high computational complexity. Therefore, we approximate the ILP with a baseline genetic algorithm, which is further improved for its optimality and scalability. Experimental results show that our migration-based defense can not only provide excellent security guarantees and affordable performance cost in both theoretical simulation and practical cloud environment, but also achieve better optimality and scalability than previous countermeasures.

An Efficient Method against Side-Channel Attacks on ECC

Side-channel attacks （SCA） may exploit leakage information to break cryptosystems. In this paper we present a new SCA resistant Elliptic Curve scalar multiplication algorithm. The proposed algorithm, builds a sequence of bit-strings representing the scalar k, characterized by the fact that all bit-strings are different from zero; this property will ensure a uniform computation behavior for the algorithm, and thus will make it secure against simple power analysis attacks （SPA）. With other randomization techniques, the proposed countermeasures do not penalize the computation time. The proposed scheme is more efficient than MOEller＇s one, its cost being about 5% to 10% smaller than MOEller＇s one.

Side-Channel Attacks Based on Collaborative Learning

Side-channel attacks based on supervised learning require that the attacker have complete control over the cryptographic device and obtain a large number of labeled power traces.However,in real life,this requirement is usually not met.In this paper,an attack algorithm based on collaborative learning is proposed.The algorithm only needs to use a small number of labeled power traces to cooperate with the unlabeled power trace to realize the attack to cryptographic device.By experimenting with the DPA contest V4 dataset,the results show that the algorithm can improve the accuracy by about 20%compared with the pure supervised learning in the case of using only 10 labeled power traces.

Side-channel attack-resistant AES S-box with hidden subfield inversion and glitch-free masking

A side-channel attack(SCA)-resistant AES S-box implementation is proposed,which is an improvement from the power-aware hiding(PAH)S-box but with higher security and a smaller area.We use the composite field approach and apply the PAH method to the inversion in the nonlinear kernel and a masking method to the other parts.In addition,a delaymatched enable control technique is used to suppress glitches in the masked parts.The evaluation results show that its area is contracted to 63.3%of the full PAH S-box,and its power-delay product is much lower than that of the masking implementation.The leakage assessment using simulation power traces concludes that it has no detectable leakage under t-test and that it at least can thwart the moment-correlation analysis using 665000 noiseless traces.

Detection Technique of Software-Induced Rowhammer Attacks

Side-channel attacks have recently progressed into software-induced attacks.In particular,a rowhammer attack,which exploits the characteristics of dynamic random access memory(DRAM),can quickly and continuously access the cells as the cell density of DRAM increases,thereby generating a disturbance error affecting the neighboring cells,resulting in bit flips.Although a rowhammer attack is a highly sophisticated attack in which disturbance errors are deliberately generated into data bits,it has been reported that it can be exploited on various platforms such as mobile devices,web browsers,and virtual machines.Furthermore,there have been studies on bypassing the defense measures of DRAM manufacturers and the like to respond to rowhammer attacks.A rowhammer attack can control user access and compromise the integrity of sensitive data with attacks such as a privilege escalation and an alteration of the encryption keys.In an attempt to mitigate a rowhammer attack,various hardware-and software-based mitigation techniques are being studied,but there are limitations in that the research methods do not detect the rowhammer attack in advance,causing overhead or degradation of the system performance.Therefore,in this study,a rowhammer attack detection technique is proposed by extracting common features of rowhammer attack files through a static analysis of rowhammer attack codes.

x86处理器向量条件访存指令安全脆弱性分析

单指令多数据流(Single Instruction stream,Multiple Data streams,SIMD)是一种利用数据级并行提高处理器性能的技术,旨在利用多个处理器并行执行同一条指令增加数据处理的吞吐量.随着大数据、人工智能等技术的兴起,人们对数据并行化处理的需求不断提高,这使得SIMD技术愈发重要.为了支持SIMD技术,Intel和AMD等x86处理器厂商从1996年开始在其处理器中陆续引入了MMX(MultiMedia Extensions)、SSE(Streaming SIMD Extensions)、AVX(Advanced Vector eXtensions)等SIMD指令集扩展.通过调用SIMD指令,程序员能够无需理解SIMD技术的硬件层实现细节就方便地使用它的功能.然而,随着熔断、幽灵等处理器硬件漏洞的发现,人们逐渐认识到并行优化技术是一柄双刃剑,它在提高性能的同时也能带来安全风险.本文聚焦于x86 SIMD指令集扩展中的VMASKMOV指令,对它的安全脆弱性进行了分析.本文的主要贡献如下:(1)利用时间戳计数器等技术对VMASKMOV指令进行了微架构逆向工程,首次发现VMASKMOV指令与内存页管理和CPU Fill Buffer等安全风险的相关性;(2)披露了一个新的处理器漏洞EvilMask,它广泛存在于Intel和AMD处理器上,并提出了3个EvilMask攻击原语:VMASKMOVL+Time(MAP)、VMASKMOVS+Time(XD)和VMASKMOVL+MDS,可用于实施去地址空间布局随机化攻击和进程数据窃取攻击;(3)给出了2个EvilMask概念验证示例(Proof-of-Concept,PoC)验证了EvilMask对真实世界的信息安全危害;(4)讨论了针对EvilMask的防御方案,指出最根本的解决方法是在硬件层面上重新实现VMASKMOV指令,并给出了初步的实现方案.

Enhancing non-profiled side-channel attacks by time-frequency analysis

Side-channel analysis(SCA)has become an increasing important method to assess the physical security of cryptographic systems.In the process of SCA,the number of attack data directly determines the performance of SCA.With sufficient attack data,the adversary can achieve a successful SCA.However,in reality,the cryptographic device may be protected with some countermeasures to limit the number of encryptions using the same key.In this case,the adversary cannot use casual numbers of data to perform SCA.The performance of SCA will be severely dropped if the attack traces are insufficient.In this paper,we introduce wavelet scatter transform(WST)and short-time fourier transform(STFT)to non-profiled side-channel analysis domains,to improve the performance of side-channel attacks in the context of insufficient data.We design a practical framework to provide suitable parameters for WST/STFT-based SCA.Using the proposed method,the WST/STFT-based SCA method can significantly enhance the performance and robustness of non-profiled SCA.The practical attacks against four public datasets show that the proposed method is able to achieve more robust performance.Compared with the original correlation power analysis(CPA),the number of attack data can be reduced by 50–95%.

Timing Attack Analysis on AA_βCryptosystem

Timing attack is an attack on the implementation of a cryptographic primitive. The attack collects leaked secret data via certain implementation techniques either on software or hardware. This paper provides an analysis of a theoretical timing attack on the AAβ algorithm. The attack discussed in this paper gives avenues for secure implementation of AAβ against timing attacks. The simulation of the attack is important to provide invulnerability features for the algorithm in order to be implemented and embedded on applications. At the end of the attack, a method to overcome it will be introduced and it is called AAβ blinding.

Side-Channel Analysis for Detecting Protocol Tunneling

Protocol tunneling is widely used to add security and/or privacy to Internet applications. Recent research has exposed side channel vulnerabilities that leak information about tunneled protocols. We first discuss the timing side channels that have been found in protocol tunneling tools. We then show how to infer Hidden Markov models (HMMs) of network protocols from timing data and use the HMMs to detect when protocols are active. Unlike previous work, the HMM approach we present requires no a priori knowledge of the protocol. To illustrate the utility of this approach, we detect the use of English or Italian in interactive SSH sessions. For this example application, keystroke-timing data associates inter-packet delays with keystrokes. We first use clustering to extract discrete information from continuous timing data. We use discrete symbols to infer a HMM model, and finally use statistical tests to determine if the observed timing is consistent with the language typing statistics. In our tests, if the correct window size is used, fewer than 2% of data windows are incorrectly identified. Experimental verification shows that on-line detection of language use in interactive encrypted protocol tunnels is reliable. We compare maximum likelihood and statistical hypothesis testing for detecting protocol tunneling. We also discuss how this approach is useful in monitoring mix networks like The Onion Router (Tor).

Side-channel analysis attacks based on deep learning network

There has been a growing interest in the sidechannel analysis(SCA)field based on deep learning(DL)technology.Various DL network or model has been developed to improve the efficiency of SCA.However,few studies have investigated the impact of the different models on attack results and the exact relationship between power consumption traces and intermediate values.Based on the convolutional neural network and the autoencoder,this paper proposes a Template Analysis Pre-trained DL Classification model named TAPDC which contains three sub-networks.The TAPDC model detects the periodicity of power trace,relating power to the intermediate values and mining the deeper features by the multi-layer convolutional net.We implement the TAPDC model and compare it with two classical models in a fair experiment.The evaluative results show that the TAPDC model with autoencoder and deep convolution feature extraction structure in SCA can more effectively extract information from power consumption trace.Also,Using the classifier layer,this model links power information to the probability of intermediate value.It completes the conversion from power trace to intermediate values and greatly improves the efficiency of the power attack.

Hardware Security for IoT in the Quantum Era: Survey and Challenges

The Internet of Things (IoT) has become a reality: Healthcare, smart cities, intelligent manufacturing, e-agriculture, real-time traffic controls, environment monitoring, camera security systems, etc. are developing services that rely on an IoT infrastructure. Thus, ensuring the security of devices during operation and information exchange becomes a fundamental requirement inherent in providing safe and reliable IoT services. NIST requires hardware implementations that are protected against SCAs for the lightweight cryptography standardization process. These attacks are powerful and non-invasive and rely on observing the physical properties of IoT hardware devices to obtain secret information. In this paper, we present a survey of research on hardware security for the IoT. In addition, the challenges of IoT in the quantum era with the first results of the NIST standardization process for post-quantum cryptography are discussed.

Driftor: mitigating cloud-based side-channel attacks by switching and migrating multi-executor virtual machines

Co-residency of different tenants’ virtual machines(VMs) in cloud provides a good chance for side-channel attacks, which results in information leakage. However, most of current defense suffers from the generality or compatibility problem, thus failing in immediate real-world deployment. VM migration, an inherit mechanism of cloud systems, envisions a promising countermeasure, which limits co-residency by moving VMs between servers. Therefore, we first set up a unified practical adversary model, where the attacker focuses on effective side channels. Then we propose Driftor, a new cloud system that contains VMs of a multi-executor structure where only one executor is active to provide service through a proxy, thus reducing possible information leakage. Active state is periodically switched between executors to simulate defensive effect of VM migration. To enhance the defense, real VM migration is enabled at the same time. Instead of solving the migration satisfiability problem with intractable CIRCUIT-SAT, a greedy-like heuristic algorithm is proposed to search for a viable solution by gradually expanding an initial has-to-migrate set of VMs. Experimental results show that Driftor can not only defend against practical fast side-channel attack, but also bring about reasonable impacts on real-world cloud applications.

Side-Channel Attacks in a Real Scenario

Existing Side-Channel Attacks （SCAs） have several limitations and, rather than to be real attack methods, can only be considered to be security evaluation methods. Their limitations are mainly related to the sampling conditions, such as the trigger signal embedded in the source code of the encryption device, and the acquisition device that serves as the encryption-device controller. Apart from it being very difficult for an attacker to add a trigger into the original design before making an attack or to control the encryption device, there is a big gap in the capacity of existing SCAs to pose real threats to cipher devices. In this paper, we propose a new method, the sliding window SCA （SW-SCA）, which can be applied in scenarios in which the acquisition device is independent of the encryption device and for which the encryption source code requires no trigger signal or modification. First, we describe the main issues in existing SCAs, then we theoretically analyze the effectiveness and complexity of our proposed SW-SCA --a method that can incorporate a sliding-window mechanism into almost all of the existing non-profiled SCAs. The experimental results for both simulated and physical traces verify the effectiveness of the SW-SCA and the appropriateness of its theoretical complexity.

微架构瞬态执行攻击与防御方法

现代处理器的优化技术,包括乱序执行和推测机制等,对性能至关重要.以Meltdown和Spectre为代表的侧信道攻击表明:由于异常延迟处理和推测错误而执行的指令结果虽然在架构级别上未显示,但仍可能在处理器微架构状态中留下痕迹.通过隐蔽信道可将微架构状态的变化传输到架构层,进而恢复出秘密数据,这种攻击方式称为瞬态执行攻击.该攻击有别于传统的缓存侧信道攻击,影响面更广,缓解难度更大.深入分析了瞬态执行攻击的机理和实现方式,对目前的研究现状与防御方法进行了总结.首先,介绍了处理器微架构采用的优化技术,并分析了其导致瞬态执行攻击的功能特征;然后,基于触发瞬态执行的原语对瞬态执行攻击进行系统化分析,揭示攻击面上的明显差异;最后,有侧重点地针对攻击模型中的关键步骤和关键组件总结了已有的防御方法,并展望了未来的研究方向.

缓存侧信道防御研究综述

微架构侧信道攻击(microarchitectural side channel attack)是一种利用处理器微架构状态开展侧信道攻击的方式.它打破了操作系统及其他软件层面提供的隔离手段,严重威胁了用户的信息安全,受到了学术界的广泛关注.与其他传统侧信道攻击不同,微架构侧信道攻击不需要攻击者与被攻击对象存在物理接触,也不需要复杂的分析设备,它只需要能够与受害者在同一环境中执行代码就可以完成攻击.基于缓存的侧信道攻击(cache-based side channel attack)利用处理器中广泛存在的缓存(cache)结构,所以这种攻击方式最有吸引力,研究也最为深入.首先总结了微架构侧信道攻击尤其是缓存侧信道攻击相关的硬件架构,之后从攻击者能力、攻击步骤以及攻击目标对攻击模型进行讨论,并根据攻击模型对现有的防御措施进行分类和比较,重点介绍了新型安全缓存架构及其设计方案,最后讨论了现有防御措施面临的挑战以及未来的研究方向.

UTILITY ANALYSIS AND EVALUATION METHOD STUDY OF SIDE CHANNEL INFORMATION

In order to improve the efficiency and success rate of the side channel attack,the utility of side channel information of the attack object must be analyzed and evaluated before the attack implementation.Based on the study of side-channel attack techniques,a method is proposed in this paper to analyze and evaluate the utility of side channel information and the evaluation indexes of comentropy,Signal-to-Noise Ratio(SNR)are introduced.On this basis,the side channel information(power and electromagnetic)of a side channel attack experiment board is analyzed and evaluated,and the Data Encryption Standard(DES)cipher algorithm is attacked with the differential power attack method and differential electromagnetic attack method.The attack results show the effectiveness of the analysis and evaluation method proposed in this paper.

基于边界检测的安全数据预取方案

为了不断提升微处理器的性能,现代微处理器当中包含了越来越多用于性能优化的部件,比如高速缓存,分支预测器,数据预取器等,这些性能优化部件在给微处理器带来可观的性能提升的同时,也引入了一定的安全隐患。比如高速缓存引入的侧信道,分支预测引入的“幽灵”漏洞等等,与上述两个性能优化部件类似,数据预取也存在安全隐患,然而却未引起足够的重视。数据预取的根本目的在于提升高速缓存命中率,主要通过观察程序的访存行为规律提前将所需的数据加载到高速缓存当中,是现今高性能微处理器当中重要的微处理器性能优化技术。近来有研究表明,数据预取会引入侧信道,造成信息泄露,对微处理器的整体安全性造成了一定的威胁,然而目前却鲜有关于如何对数据预取安全缺陷进行防御的相关研究。性能优化部件之所以引入安全风险的根本在于其具有推测性,当推测的处理器行为与实际的行为不符时,便会在处理器内部遗留下“脏数据”,这些“脏数据”有可能来自于越权或者越界访问。本文重点分析了硬件数据预取目前面临的安全风险及其产生原因,提出了安全的数据预取行为规范,在开源处理器BOOM(Berkeley Out of Order Machine)上实现了基于指令指针(instruction pointer)的步距预取器,同时依据上述安全的数据预取行为规范,实现了具有边界检测功能的安全数据预取系统,最后对其安全性和性能开销进行了简要评估。

Correlated Extra Reductions Defeat Fixed Window Exponentiation

The security of modular power algorithm is a very important research topic, which is the core operation of public key cryptography algorithm. Since the first timing attack was public in 1996, the attacker can exploit time differences between specific events to recover a secret key. In 2016, Dugardin took advantage of extra reductions to attack a regular exponentiation algorithm, which did not entirely adapt the fixed window method with Montgomery’s algorithm. The central thesis of this paper is that there exists a positive correlation between extra reductions of pre-computation and post-computation when the calculation has the same multiplier factor. In this article, basing on this dependency we present an attack method, and confirm the feasibility and effectiveness of it by conducting simulation experiments. Experimental results verify that the method can effectively attack modular power algorithm.

Malware Guard Extension:abusing Intel SGX to conceal cache attacks

In modern computer systems,user processes are isolated from each other by the operating system and the hardware.Additionally,in a cloud scenario it is crucial that the hypervisor isolates tenants from other tenants that are co-located on the same physical machine.However,the hypervisor does not protect tenants against the cloud provider and thus,the supplied operating system and hardware.Intel SGX provides a mechanism that addresses this scenario.It aims at protecting user-level software from attacks from other processes,the operating system,and even physical attackers.In this paper,we demonstrate fine-grained software-based side-channel attacks from a malicious SGX enclave targeting co-located enclaves.Our attack is the first malware running on real SGX hardware,abusing SGX protection features to conceal itself.Furthermore,we demonstrate our attack both in a native environment and across multiple Docker containers.We perform a Prime+Probe cache side-channel attack on a co-located SGX enclave running an up-to-date RSA implementation that uses a constant-time multiplication primitive.The attack works,although in SGX enclaves,there are no timers,no large pages,no physical addresses,and no shared memory.In a semi-synchronous attack,we extract 96%of an RSA private key from a single trace.We extract the full RSA private key in an automated attack from 11 traces within 5 min.

面向侧信道防御的安全除法器设计

在利用运算部件的侧信道计时攻击及防御方法基础上,针对密码系统中常用的除法部件,基于固定延迟和可变延迟除法算法,进行面向侧信道防御的安全除法器设计。该设计兼顾性能和安全,适用于不同需求的工作环境。实验结果证明了该方法的有效性,尤其适合面向IoT应用的低功耗嵌入式处理器使用。