SpecSafe: detecting cache side channels in a speculative world
SpecSafe: detecting cache side channels in a speculative world
复制标题
DOI：
10.1145/3485506
复制
发表时间：
2021-10
影响因子：
--
通讯作者：
Robert Brotzman;Danfeng Zhang;M. Kandemir;Gang Tan
中科院分区：
文献类型：
--
作者：
Robert Brotzman;Danfeng Zhang;M. Kandemir;Gang Tan
备受瞩目的Spectre攻击及其变体表明，推测性执行可能会在缓存中留下依赖于秘密的足迹，从而使攻击者能够了解机密数据。然而，现有的静态侧信道检测器要么忽略推测执行，导致误报，要么缺乏精确的缓存模型，导致误报。在本文中，有些令人惊讶的是，我们表明，使用精确的缓存模型开发具有推测意识的静态分析是具有挑战性的：现有工作的组合不一定能捕获所有缓存侧通道。基于这一观察，我们提出了一种新的针对基于缓存的侧信道攻击的安全语义定义，称为推测感知不干扰（SANI），它适用于各种攻击和缓存模型。我们还开发了SpecSafe来检测违反SANI的行为。与其他投机感知的符号执行器不同，SpecSafe采用了一种新颖的程序转换，因此SANI可以被投机感知的侧信道检测器完全检查。在一组中等大小的基准测试（包括常用的加密库）上，SpecSafe被证明既可扩展又准确。
The high-profile Spectre attack and its variants have revealed that speculative execution may leave secret-dependent footprints in the cache, allowing an attacker to learn confidential data. However, existing static side-channel detectors either ignore speculative execution, leading to false negatives, or lack a precise cache model, leading to false positives. In this paper, somewhat surprisingly, we show that it is challenging to develop a speculation-aware static analysis with precise cache models: a combination of existing works does not necessarily catch all cache side channels. Motivated by this observation, we present a new semantic definition of security against cache-based side-channel attacks, called Speculative-Aware noninterference (SANI), which is applicable to a variety of attacks and cache models. We also develop SpecSafe to detect the violations of SANI. Unlike other speculation-aware symbolic executors, SpecSafe employs a novel program transformation so that SANI can be soundly checked by speculation-unaware side-channel detectors. SpecSafe is shown to be both scalable and accurate on a set of moderately sized benchmarks, including commonly used cryptography libraries.