Chronos vs. Chaos
Chronos vs. Chaos
复制标题
克罗诺斯与混沌
DOI：
10.1145/3510548.3519371
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Dawson S
中科院分区：
文献类型：
--
作者：
Dawson S
时间是侧信道攻击区分执行类别的关键指标之一。例如，推测性执行可以在体系结构中被指定为没有可见的副作用，但是对于某些具体的微体系结构实现，仍然可以访问该高速缓存。缓存侧信道攻击通过测量在某组缓存前提条件下完成内存访问所需的时间来解释此信号，从而揭示某些预期保持不透明的机器状态。微架构中负责这些行为的一些推测性结构（例如存储缓冲区）也会在正确的条件下暴露可见的无序或“弱内存”执行。这项工作调查的环境条件下，可见的弱内存执行发生，以及是否有一个微架构的“信号”与这些执行，可以暴露。这是我们的假设，这些特征可以用来识别微架构的推测，可能会导致弱内存行为，并在这些执行中发挥作用的机制，如果随后回滚，可能会引起缓存的副作用，必要的建设瞬态执行攻击。kerntime是一个内核模式实用程序，它为弱内存石蕊测试的执行时间提供周期级粒度。我们使用kerntime来分析x86上存在的Store Buffering行为的时序配置文件，并根据kerntime生成的数据集的观察结果开发特性，包括Store Buffering行为的线程本地指示器。
Timing is one of the key metrics by which side-channel attacks distinguish between classes of executions. For example, a speculative execution may be specified in the architecture as having no visible side-effects, but the cache may still be accessed for some concrete micro-architecture implementation. Cache side-channel attacks interpret this signal by measuring the time a memory access will take to complete under some set of cache preconditions, in turn revealing some machine state that is expected to remain opaque. Some of the speculative structures in the micro-architecture (such as the Store Buffer) responsible for these behaviours also expose visible out-of-order, or "weak memory" execution under the correct conditions. This work investigates the environmental conditions under which visible weak memory executions occur and whether there is a micro architectural "signal" associated with those executions that can be exposed. It is our hypothesis that these characteristics can be used to identify micro-architectural speculation that may lead to weak-memory behaviour, and that the mechanisms at play in these executions, if subsequently rolled back, may induce cache side effects necessary for building transient execution attacks. kerntime is a kernel-mode utility that provides cycle-level granularity for execution time of weak memory litmus tests. We use kerntime to analyse the timing profile of Store Buffering behaviour present on x86 and develop characteristics based on observations from the dataset generated by kerntime, including a thread local indicator of Store Buffering behaviour.