Leveraging EM Side-Channel Information to Detect Rowhammer Attacks
Leveraging EM Side-Channel Information to Detect Rowhammer Attacks
复制标题
DOI：
10.1109/sp40000.2020.00060
复制
发表时间：
2020-05
期刊：
影响因子：
--
通讯作者：
Zhenkai Zhang;Zihao Zhan;D. Balasubramanian;B. Li;P. Völgyesi;X. Koutsoukos
中科院分区：
文献类型：
--
作者：
Zhenkai Zhang;Zihao Zhan;D. Balasubramanian;B. Li;P. Völgyesi;X. Koutsoukos
Rowhammer错误属于软件引起的硬件故障，并已利用形成各种强大的Rowhammer攻击。但是，如何有效检测这种攻击仍然是一个具有挑战性的问题。在本文中，我们提出了一种名为Radar的新方法（通过无线电攻击检测），该方法利用某些电磁（EM）信号来检测Rowhammer攻击。特别是，我们发现在DRAM时钟信号的光谱中存在可识别的锤击侧带模式。由于这种模式是锤击DRAM的不可避免的物理副作用，因此它们可以“暴露”任何潜在的行锤攻击，包括隐藏在加密和孤立的环境中的极为难以捉摸的攻击，例如英特尔SGX Enclaves。但是，由于常见的计算机系统中传播光谱时钟（SSC）的使用，感兴趣的模式可能变得不合时宜。我们提出了一种驱散方法，可以重新组装由SSC分散的锤击相关的边带模式。使用通用分类技术，我们可以在各种情况下对雷达原型进行评估，以实现有效且强大的防御针对行锤攻击的防御。此外，我们的雷达不会在受保护的系统上施加任何性能开销。先前几乎没有使用物理侧通道信息来执行Rowhammer防御措施，据我们所知，这是为此目的利用EM侧通道信息的首次调查。
The rowhammer bug belongs to software-induced hardware faults, and has been exploited to form a wide range of powerful rowhammer attacks. Yet, how to effectively detect such attacks remains a challenging problem. In this paper, we propose a novel approach named RADAR (Rowhammer Attack Detection via A Radio) that leverages certain electromagnetic (EM) signals to detect rowhammer attacks. In particular, we have found that there are recognizable hammering-correlated sideband patterns in the spectrum of the DRAM clock signal. As such patterns are inevitable physical side effects of hammering the DRAM, they can "expose" any potential rowhammer attacks including the extremely elusive ones hidden inside encrypted and isolated environments like Intel SGX enclaves. However, the patterns of interest may become unapparent due to the common use of spread-spectrum clocking (SSC) in computer systems. We propose a de-spreading method that can reassemble the hammering-correlated sideband patterns scattered by SSC. Using a common classification technique, we can achieve both effective and robust detection-based defense against rowhammer attacks, as evaluated on a RADAR prototype under various scenarios. In addition, our RADAR does not impose any performance overhead on the protected system. There has been little prior work that uses physical side-channel information to perform rowhammer defenses, and to the best of our knowledge, this is the first investigation on leveraging EM side-channel information for this purpose.