TWC: Small: MIST: Systematic Analysis of Microarchitectural Information Leakage on Mobile Platforms

TWC：小：MIST：移动平台微架构信息泄露的系统分析

• 批准号: 1618837
• 负责人: Thomas Eisenbarth
• 金额: $ 50万
• 依托单位: Worcester Polytechnic Institute
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2016
• 资助国家: 美国
• 起止时间: 2016-08-01 至 2019-07-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=1618837&HistoricalAwards=false
• 关键词: TWC; Small; MIST; Systematic; Analysis

Smart phones have permeated all facets of our lives facilitating daily activities from shopping to social interactions. Mobile devices collect sensitive information about our behavior via various sensors. Operating systems (OS)enforce strict isolation between apps to protect data and complex permission management. Yet, apps get free access to hardware including CPU and caches. Access to shared hardware resources result in information leakage across apps. Microarchitectural attacks have already proven to succeed in stealing information on PC and even on virtualized cloud servers. This project (MIST) quantifies the vulnerability of mobile platforms to microarchitectural attacks and develops countermeasures. MIST systematically explores which resources enable these attacks on the mobile platform, identifies mechanisms that are essential to an attack, and quantifies the amount of information obtainable from given resources. By making use of machine learning techniques, methods for detecting malicious code exploiting microarchitectural leakage are developed. To remedy microarchitectural attacks, MIST explores countermeasures that can manage resources in a way that they are no longer exploitable by side channels. In addition, tools that help app developers prevent leakage when writing code processing sensitive information are provided. The studied detection and prevention techniques apply to a wide range of interactions as experienced in mobile computing today. Thereby, MIST helps to secure personal information stored on mobile platforms with immediate benefits to virtually all mobile platform users. Many of the envisioned Internet of Things hubs build on the same platforms, further increasing the impact of this research.

智能手机已经渗透到我们生活的方方面面，为日常活动提供便利，从购物到社交互动。移动设备通过各种传感器收集有关我们行为的敏感信息。操作系统（OS）在应用程序之间强制严格隔离，以保护数据和复杂的权限管理。然而，应用程序可以免费访问包括CPU和缓存在内的硬件。访问共享硬件资源会导致跨应用程序的信息泄漏。微架构攻击已经被证明可以成功窃取个人电脑甚至虚拟化云服务器上的信息。该项目（MIST）量化了移动平台对微架构攻击的脆弱性，并制定了对策。MIST系统地探索哪些资源可以在移动平台上进行这些攻击，确定攻击的基本机制，并量化从给定资源中获得的信息量。通过利用机器学习技术，开发了检测利用微架构泄漏的恶意代码的方法。为了补救微体系结构攻击，MIST探索了能够以一种不再被侧通道利用的方式管理资源的对策。此外，还提供了帮助应用程序开发人员在编写处理敏感信息的代码时防止泄漏的工具。所研究的检测和预防技术适用于今天在移动计算中所经历的广泛的交互。因此，MIST有助于确保存储在移动平台上的个人信息的安全，几乎所有移动平台用户都能立即受益。许多设想中的物联网中心都建立在相同的平台上，这进一步增加了这项研究的影响。