An Exploration of ARM System-Level Cache and GPU Side Channels
An Exploration of ARM System-Level Cache and GPU Side Channels
复制标题
DOI：
10.1145/3485832.3485902
复制
发表时间：
2021-12
期刊：
影响因子：
--
通讯作者：
P. Cronin;Xing Gao;Haining Wang;Chase Cotton
中科院分区：
文献类型：
--
作者：
P. Cronin;Xing Gao;Haining Wang;Chase Cotton
高级RISC机器(ARM)处理器最近在云计算和桌面应用程序中都获得了市场份额。与此同时，ARM设备已经转向更基于外围设备的设计，在这种设计中，设计者在片上系统(SoC)上附加了许多协处理器和加速器。通过采用系统级缓存，作为CPU核心和外围设备之间的共享缓存，ARM试图缓解数据源和加速器之间存在的内存瓶颈问题。本文研究了这种新的系统级缓存带来的新的安全威胁。具体地说，我们证明了系统级缓存仍然可以被利用来创建缓存占用通道，以准确地提取网站的指纹。在ARM缓存设计的基础上，对不同浏览器的攻击进行了重新设计和优化，在提高精确度的同时，显著缩短了攻击持续时间。此外，我们在移动设备中引入了一种新的GPU竞争通道，该通道可以达到与缓存占用通道相似的精度。我们通过检查多个设备上的这些攻击进行了彻底的评估，包括iOS、Android和使用新的M1 MacBook Air的MacOS。实验结果表明：(1)基于系统级缓存的网站指纹识别技术在开放(高达90%)和封闭(高达95%)两种场景下都能达到较好的准确率；(2)在Android设备上，我们的GPU竞争通道比CPU缓存通道更有效。
Advanced RISC Machines (ARM) processors have recently gained market share in both cloud computing and desktop applications. Meanwhile, ARM devices have shifted to a more peripheral based design, wherein designers attach a number of coprocessors and accelerators to the System-on-a-Chip (SoC). By adopting a System-Level Cache, which acts as a shared cache between the CPU-cores and peripherals, ARM attempts to alleviate the memory bottleneck issues that exist between data sources and accelerators. This paper investigates emerging security threats introduced by this new System-Level Cache. Specifically, we demonstrate that the System-Level Cache can still be exploited to create a cache occupancy channel to accurately fingerprint websites. We redesign and optimize the attack for various browsers based on the ARM cache design, which can significantly reduce the attack duration while increasing accuracy. Moreover, we introduce a novel GPU contention channel in mobile devices, which can achieve similar accuracy to the cache occupancy channel. We conduct a thorough evaluation by examining these attacks across multiple devices, including iOS, Android, and MacOS with the new M1 MacBook Air. The experimental results demonstrate that (1) the System-Level Cache based website fingerprinting technique can achieve promising accuracy in both open (up to 90%) and closed (up to 95%) world scenarios, and (2) our GPU contention channel is more effective than the CPU cache channel on Android devices.