TWC: Small: MIST: Systematic Analysis of Microarchitectural Information Leakage on Mobile Platforms

智能手机已经渗透到我们生活的方方面面，方便了从购物到社交的日常活动。移动设备通过各种传感器收集有关我们行为的敏感信息。操作系统(OS)在应用程序之间实施严格的隔离以保护数据和复杂的权限管理。然而，应用程序可以免费访问包括CPU和缓存在内的硬件。对共享硬件资源的访问会导致应用程序之间的信息泄漏。微体系结构攻击已经被证明成功地窃取了PC上的信息，甚至是虚拟云服务器上的信息。该项目(MIST)量化了移动平台对微体系结构攻击的脆弱性，并开发了对策。MIST系统地探索哪些资源支持移动平台上的这些攻击，识别对攻击至关重要的机制，并量化可从给定资源获得的信息量。利用机器学习技术，提出了利用微体系结构漏洞检测恶意代码的方法。为了补救微体系结构攻击，MIST探索了一些对策，这些对策可以管理资源，使它们不再被旁路利用。此外，还提供了帮助应用程序开发人员在编写代码处理敏感信息时防止泄漏的工具。所研究的检测和预防技术适用于当今移动计算中所经历的广泛交互。因此，MIST有助于保护存储在移动平台上的个人信息，几乎所有移动平台用户都能立即受益。许多设想的物联网枢纽都建立在相同的平台上，进一步增加了这项研究的影响。

Smart phones have permeated all facets of our lives facilitating daily activities from shopping to social interactions. Mobile devices collect sensitive information about our behavior via various sensors. Operating systems (OS)enforce strict isolation between apps to protect data and complex permission management. Yet, apps get free access to hardware including CPU and caches. Access to shared hardware resources result in information leakage across apps. Microarchitectural attacks have already proven to succeed in stealing information on PC and even on virtualized cloud servers. This project (MIST) quantifies the vulnerability of mobile platforms to microarchitectural attacks and develops countermeasures. MIST systematically explores which resources enable these attacks on the mobile platform, identifies mechanisms that are essential to an attack, and quantifies the amount of information obtainable from given resources. By making use of machine learning techniques, methods for detecting malicious code exploiting microarchitectural leakage are developed. To remedy microarchitectural attacks, MIST explores countermeasures that can manage resources in a way that they are no longer exploitable by side channels. In addition, tools that help app developers prevent leakage when writing code processing sensitive information are provided. The studied detection and prevention techniques apply to a wide range of interactions as experienced in mobile computing today. Thereby, MIST helps to secure personal information stored on mobile platforms with immediate benefits to virtually all mobile platform users. Many of the envisioned Internet of Things hubs build on the same platforms, further increasing the impact of this research.