Microarchitectural Minefields: 4K-Aliasing Covert Channel and Multi-Tenant Detection in Iaas Clouds
Microarchitectural Minefields: 4K-Aliasing Covert Channel and Multi-Tenant Detection in Iaas Clouds
复制标题
微架构雷区：Iaas 云中的 4K 别名隐蔽通道和多租户检测
DOI：
--
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Yier Jin
中科院分区：
文献类型：
--
作者：
Dean Sullivan;Orlando Arias;Travis Meade;Yier Jin
提出了一种新的微体系结构的时序隐蔽通道，该通道使用处理器的内存顺序缓冲器(MOB)。具体地说，我们展示了当通过存储缓冲区预测相关加载时，攻击者如何推断英特尔和IA-32体系结构上间谍进程的状态，这称为4K混叠。4K混叠事件是在处理读后写数据风险时存储器消除歧义错误预测的副作用，其中加载地址的低12位将错误地匹配驻留在MOB中的存储地址。在这项工作中，我们广泛地分析了4K混叠，并展示了一个新的计时通道，当作为超线程执行时，可以跨进程测量。然后，我们使用4K混叠在Amazon EC2和Google Compute Engine上建立一个强大的隐蔽通信通道，分别能够以1.28 Mbps和1.49 Mbps的速度进行通信。此外，我们还证明了4K混叠也可以用于可靠地检测多租户。
We introduce a new microarchitectural timing covert channel using the processor memory order buffer (MOB). Specifically, we show how an adversary can infer the state of a spy process on the Intel 64 and IA-32 architectures when predicting dependent loads through the store buffer, called 4K-aliasing. The 4K-aliasing event is a side-effect of memory disambiguation misprediction while handling write-after-read data hazards wherein the lower 12-bits of a load address will falsely match with store addresses resident in the MOB. In this work, we extensively analyze 4K-aliasing and demonstrate a new timing channel measureable across processes when executed as hyperthreads. We then use 4K-aliasing to build a robust covert communication channel on both the Amazon EC2 and Google Compute Engine capable of communicating at speeds of 1.28 Mbps and 1.49 Mbps, respectively. In addition, we show that 4K-aliasing can also be used to reliably detect multi-tenancy.