Indistinguishability Prevents Scheduler Side Channels in Real-Time Systems
Indistinguishability Prevents Scheduler Side Channels in Real-Time Systems
复制标题
DOI：
10.1145/3460120.3484769
复制
发表时间：
2021-11
期刊：
影响因子：
--
通讯作者：
Chien-Ying Chen;Debopam Sanyal;Sibin Mohan
中科院分区：
文献类型：
--
作者：
Chien-Ying Chen;Debopam Sanyal;Sibin Mohan
调度器侧信道可能会在实时系统中泄露关键信息，从而对许多安全关键型应用构成严重威胁。主要原因是此类系统运行时定时行为中固有的确定性，例如关键任务的（预期的）周期性行为。在本文中，我们引入“调度不可区分性”的概念，该概念受差分隐私相关工作的启发，在为这类系统的调度引入多样性的同时提供可分析的安全保证。我们通过向任务调度添加足够大的（受控的）噪声来打破其确定性执行模式来实现这一点。然后，一个“ε - 调度器”在实时Linux中实现调度不可区分性。我们使用两个实际应用对我们的系统进行评估：(a) 在真实硬件平台（树莓派）上运行的自主探测车，以及(b) 在大地理距离上发送数据的视频流应用。我们的结果表明，ε - 调度器在实时系统中针对调度器侧信道攻击提供了更好的保护，同时仍然保持良好的性能和服务质量（QoS）要求。
Scheduler side-channels can leak critical information in real-time systems, thus posing serious threats to many safety-critical applications. The main culprit is the inherent determinism in the runtime timing behavior of such systems, e.g., the (expected) periodic behavior of critical tasks. In this paper, we introduce the notion of "schedule indistinguishability/", inspired by work in differential privacy, that introduces diversity into the schedules of such systems while offering analyzable security guarantees. We achieve this by adding a sufficiently large (controlled) noise to the task schedules in order to break their deterministic execution patterns. An "epsilon-Scheduler" then implements schedule indistinguishability in real-time Linux. We evaluate our system using two real applications: (a) an autonomous rover running on a real hardware platform (Raspberry Pi) and (b) a video streaming application that sends data across large geographic distances. Our results show that the epsilon-Scheduler offers better protection against scheduler side-channel attacks in real-time systems while still maintaining good performance and quality-of-service(QoS) requirements.