ARM platform cache covert communication defense method based on noise loading injection

Abstract

The invention discloses an ARM (Advanced RISC Machines) platform cache covert communication defense method based on noise loading injection, and the cache covert communication becomes possible due to the continuous expansion of a TEE (Trusted Execution Environment) attack surface and the vulnerability of a TrustZone technology in the aspect of micro-architecture isolation. On the basis of a TrustZone technology, a defense mechanism for cache covert communication is added, and a cache covert communication defense architecture based on noise loading injection is designed. Based on the architecture, a dynamic monitoring mechanism, a strategy optimization mechanism and a noise injection mechanism are provided. And the system security and the system performance are monitored through a dynamic monitoring mechanism. An optimal noise injection strategy is generated through a strategy optimization mechanism, and the noise injection frequency and intensity are calculated in real time. And data loading is carried out through a noise injection mechanism, and cache covert communication is resisted. According to the defense method, the security of the original architecture is improved, low performance overhead is realized, and the security and performance of the system are balanced.

Description

Technical Field

[0001] The invention relates to an ARM platform cache covert communication defense method based on noise loading injection in the field of ARM platform security. Background Art

[0002] TrustZone technology is introduced into embedded systems based on ARM architecture to enhance system security. TrustZone provides an isolated trusted execution environment (TEE) through hardware extension for deploying trusted applications (TA). However, there are two important challenges facing TrustZone technology: 1) As the complexity of TAs increases, the attack surface of TEE continues to expand. Any vulnerable or malicious TA may be controlled by an attacker in the ordinary execution environment (REE), thereby endangering the security of the system. 2) TrustZone does not implement secure isolation between the two worlds for microarchitecture resources (such as cache). Applications in the ordinary world (CA) can manipulate and infer the cache status of the secure world through the cache, making cache-based cross-world covert communication possible.

[0003] Therefore, due to the existence of the controlled TA, if it acts as a sender and sends secret information to an attacker in the REE through the cache, sensitive data (such as keys) in the TEE can be leaked. This cache-based cross-world covert channel established from the controlled TA breaks through the isolation mechanism of TrustZone, thus threatening the security of the entire system.

[0004] To defend against cache covert communication on ARM platforms, existing research has proposed hardware, software, and a combination of hardware and software defense solutions. The hardware solution aims to enhance the resource isolation of TrustZone and propose a new cache architecture to prevent the two worlds from communicating covertly through the cache. However, hardware modifications are difficult to deploy on most platforms. The combination of hardware and software solutions attempts to enhance the isolation between TAs, create strongly isolated compartments inside REE or TEE, and refresh the cache status when entering and leaving the compartment. Even a controlled TA cannot leak information through the cache. However, this method introduces a large overhead for large and frequent cache refreshes, which seriously affects system performance. The software solution mainly relies on a noise injection method based on cache refresh. Although the introduced defense overhead is small, it fails to fully consider a variety of cache attack modes and is difficult to deal with a variety of known cache covert communication techniques.

[0005] The noise loading injection method adopts a software architecture and can be easily deployed in the TrustZone environment of the ARM platform. Compared with the cache refresh noise injection method, it introduces less overhead and can better defend against a variety of known communication technologies by controlling the injection frequency and intensity.

[0006] In summary, the ARM platform cache covert communication defense method based on noise loading injection of the present invention can further meet the requirements of the ARM TrustZone architecture for secure world isolation, and proposes new ideas and thoughts for enhancing the security of the original architecture in view of the vulnerability of the current architecture in dealing with cache covert communication threats. Therefore, the present invention proposes an ARM platform cache covert communication defense method based on noise loading injection. Summary of the invention

[0007] In order to prevent sensitive information from leaking from TEE through cache covert communication and further enhance the security of TEE, the present invention adds a defense mechanism for cache covert communication on the basis of TrustZone technology and proposes an ARM platform cache covert communication defense method based on noise loading injection.

[0008] In order to achieve the purpose of the present invention, the present invention designs a cache covert communication defense architecture based on noise loading injection, and designs four defense modules: PerformanceCounter module, Monitor module, Manager module and NoiseInjector module. Based on this architecture, the present invention proposes a dynamic monitoring mechanism, a policy optimization mechanism and a noise injection mechanism. The system security and system performance are monitored through the dynamic monitoring mechanism. The optimal noise injection strategy is generated through the policy optimization mechanism to balance system security and performance. The defense against cache covert communication is achieved through the noise injection mechanism.

[0009] The cache covert communication defense architecture based on noise loading injection. This architecture includes four modules: PerformanceCounter module, Monitor module, Manager module and NoiseInjector module:

[0010] 1. PerformanceCounter module. The PerformanceCounter module is located in REE. Its purpose is to dynamically monitor system threats caused by cache covert communication, identify potential abnormal behaviors, and initiate subsequent defense mechanisms when abnormalities are found, passing the cache status as a threat indicator to the NoiseInjector module.

[0011] 2. Monitor module. The Monitor module is located in the REE. Its function is to dynamically monitor the performance of the defense module during the entire execution cycle of the defense module and feed it back to the NoiseInjector module as a performance indicator.

[0012] 3. Manager module. The Manager module is located in REE. Its function is to generate the optimal noise injection strategy based on the cache covert communication threat fed back by the PerformanceCounter module and the system performance fed back by the Monitor module.

[0013] 4. NoiseInjector module. The NoiseInjector module is located in REE and its function is to implement noise injection based on cache loading.

[0014] Dynamic monitoring mechanism. The dynamic monitoring mechanism includes monitoring of system threats and system performance. For system threats, the present invention identifies them by monitoring the number of cache misses, because attack behaviors often cause an abnormal increase in the number of cache misses, and the size of the cache misses can also well distinguish between normal behaviors under high load (such as stress instructions) and attack behaviors. For this reason, the present invention uses the number of cache misses as the main indicator variable of system threats. For system performance, the present invention focuses on the CPU occupancy rate, memory occupancy rate and I / O waiting time of the defense process to evaluate the consumption of system resources by the defense process.

[0015] Strategy optimization mechanism. In order to balance system security and performance overhead, the present invention introduces threat indicator variables and performance indicator variables monitored in the dynamic monitoring mechanism based on the PSO algorithm, and defines an objective function to obtain the optimal noise injection strategy for the current system. In order to meet the needs of generating the optimal strategy in real time, the key parameters and mechanisms of the PSO algorithm are dynamically adjusted to improve the optimization performance and accelerate convergence, so as to find the optimal solution faster.

[0016] Noise injection mechanism. The present invention proposes a noise injection method based on cache loading to interfere with potential cache covert communication. For the two attack scenarios of single-core and cross-core cache covert communication, the present invention designs corresponding noise injection strategies respectively. The noise injection strategy is quantified by two key parameters: noise injection frequency and noise injection intensity, which correspond to the injection time interval and the size of loaded data respectively. In addition, in order to interfere with the cache status of different cache levels, the present invention combines different cache properties on the ARM platform (such as inclusiveness and non-inclusiveness), and uses ARM's inline assembly instruction prfm to implement data block prefetching. By directly controlling the data loading process, it ensures that the target memory address is loaded into the specified cache level (such as L1 or L2), thereby achieving effective defense against the two attack scenarios.

[0017] The present invention proposes a cache covert communication defense method for ARM platform based on noise loading injection. Based on the ARMTrustZone architecture, a defense module for cache covert communication is added, and a dynamic monitoring mechanism, a policy optimization mechanism and a noise injection mechanism are proposed, which improves the security of the original architecture, achieves low performance overhead, and balances the security and performance of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 It is a schematic diagram of the overall structure of the present invention

[0019] Figure 2 This is a schematic diagram of the workflow of the PerformanceCounter module of the present invention.

[0020] Figure 3 This is a schematic diagram of the Monitor module workflow of the present invention.

[0021] Figure 4 This is a schematic diagram of the workflow of the Manager module of the present invention.

[0022] Figure 5 This is a schematic diagram of the NoiseInjector module workflow of the present invention. DETAILED DESCRIPTION

[0023] The present invention will be described in detail below with reference to the specific embodiments shown in the accompanying drawings.

[0024] Figure 1 It is the overall architecture diagram of the ARM platform cache covert communication defense method based on noise loading injection of the present invention, such as Figure 1 shown.

[0025] The present invention deploys a defense module for cache covert communication in REE, including four modules: PerformanceCounter, Monitor, Manager and NoiseInjector:

[0026] 1. PerformanceCounter module. The PerformanceCounter module is designed to dynamically monitor system threats caused by cache covert communication, identify potential abnormal behaviors, and initiate subsequent defense mechanisms when abnormalities are found.

[0027] 2. Monitor module. The Monitor module is used to dynamically monitor the performance of the defense module during the entire execution cycle of the defense module.

[0028] 3. Manager module. The Manager module is responsible for generating the optimal noise injection strategy based on the improved PSO algorithm.

[0029] 4. NoiseInjector module. The NoiseInjector module is responsible for implementing noise injection based on cache loading.

[0030] In this architecture, the PerformanceCounter module serves as the scheduling module of the entire defense process and monitors the cache usage of the system in real time (1). By dynamically analyzing the cache status, the PerformanceCounter module can identify potential abnormal behaviors, and activate the defense mechanism when an abnormality is found, and pass the cache status as a threat indicator to the Manager module (2). The Monitor module monitors the system performance in real time during the entire cycle of the defense process execution (3), and feeds back the system performance indicators to the Manager module (4). The Manager module, as the core module of the entire defense process, uses the improved PSO algorithm to generate the optimal noise injection strategy for the current covert communication threat and system performance, and passes the strategy to the NoiseInjector module (5). The NoiseInjector module implements defense against covert communication during the cache injection process (6). The defense architecture of the present invention can effectively disrupt covert communication, making it difficult for attackers to obtain effective information through execution time or PMU, and achieving effective defense against covert communication in a constantly changing threat environment. In addition, the optimized noise injection strategy also allows the system to maintain high security without significantly affecting the overall performance, thereby achieving a balance between system security and performance.

[0031] Figure 2 This is a schematic diagram of the workflow of the PerformanceCounter module. Figure 2 shown.

[0032] In order to describe the dynamic monitoring mechanism of system threats, the monitored count values ​​are first formally described as follows:

[0033] The monitored count values ​​are defined as CML1 and CML2. CML1 represents the measured value of the number of L1 cache misses. CML2 represents the measured value of the number of L2 cache misses. The standard thresholds are defined as CMBL1 and CMBL2. CMBL1 represents the baseline value of the number of L1 cache misses, and CMBL2 represents the baseline value of the number of L2 cache misses. When a system threat is detected, CM and L are defined as system threat indicator variables. CM represents the system threat level, CM=CML1||CML2, L represents the monitored attack scenario, L=1||2, 1 represents a single-core attack, and noise will be injected into the L1 cache. 2 represents a cross-core attack, and noise will be injected into the L2 cache.

[0034] The working process of the PerformanceCounter module will be described in detail according to the above formal language description:

[0035] Step 21, counter initialization operation. The PerformanceCounter module creates two monitoring events to monitor the L1 and L2 cache miss events respectively.

[0036] Step 22, counter reset operation. Clear the counters of the two monitoring events to 0.

[0037] Step 23, counter enabling operation. Start counting for the above two counters.

[0038] Step 24, wait for the measurement time, which is the set monitoring time period.

[0039] Step 25, counter disabling operation. Stop counting for the above two counters.

[0040] Step 26, read the counter values. Obtain the measurement values CML1 and CML2 this time through the perf_event_open system call.

[0041] Step 27, determine whether (CML1>CMBL1) && (CML2>CMBL2) is satisfied. If it is satisfied, a cross-core cache attack is detected, and step 28 is executed; otherwise, step 29 is executed.

[0042] Step 28, calculate CM and L. CM = CML2, L = 2.

[0043] Step 29, determine whether (CML1>CMBL1) && (CML2<CMBL2) is satisfied. If it is satisfied, a single-core cache attack is detected, and step 210 is executed. If it is not satisfied, it means that no system threat has been detected yet, and step 211 is executed.

[0044] Step 210, calculate CM and L. CM = CML1, L = 1.

[0045] Step 211, wait for the monitoring time, which represents the monitoring period of the dynamic monitoring mechanism, and then start the next dynamic monitoring of system threats.

[0046] Step 212, when a system threat is detected, the PerformanceCounter module will wake up the Manager module and the Monitor module, and pass the values of the two variables CM and L to the Manager module.

[0047] Figure 3 It is a schematic diagram of the working process of the Monitor module. As Figure 3 shown, it includes:

[0048] Step 31, initialize the performance indicator variable CPU usage , MEM usage and IO wait Among them, CPU usage Indicates the CPU usage of the defense process, reflecting the proportion of the process in the overall CPU usage of the system. usage Indicates the memory usage of the defense process, reflecting the proportion of the process in the overall system memory usage. wait The system's I / O wait time reflects the proportion of processor wait time caused by I / O operations in resource scheduling.

[0049] Step 32, construct the top command to extract relevant measurement information, including the CPU usage of the system and defense process, the memory usage, and the I / O waiting time of the system.

[0050] Step 33: execute the top command to obtain the above-mentioned related measurement information.

[0051] Step 34, parse the top command, read the command execution results line by line, and find relevant measurement information.

[0052] Step 35, calculate the performance indicator CPU usage , MEM usage and IO wait Among them, CPU usage and MEM usage is the ratio of the occupancy rate of the defense process to the occupancy rate of the entire system, IO wait It can be read directly from the execution result of the top instruction.

[0053] Step 36: After the Monitor module obtains the performance indicator, it wakes up the Manager module and sets the performance indicator variable CPU usage , MEM usage and IO wait The calculated value is passed to the Manager module.

[0054] Figure 4 It is a schematic diagram of the workflow of the Manager module of the present invention. Figure 4 As shown, including:

[0055] Step 41, setting the basic parameters of the PSO algorithm, including the number of PSO particles SWARM_SIZE and the maximum number of iterations MAX_ITER.

[0056] Step 42, dynamically calculate the noise injection frequency F N , noise injection intensity I N The search space of [min_bounds, max_bounds]. Among them, FN ∈[0,min(CM / CM0,10],I N ∈[0,10]. Initialize the particle position (noise injection frequency) and velocity (noise injection intensity) in this space.

[0057] Step 43, using the constructed objective function to evaluate the particle fitness value. The objective function is composed of two functions, the system safety index and the system performance index, which are weighted.

[0058] SPB=-a1SO+a2PO

[0059] Among them, SO is the system safety index, PO is the system performance index, and a1 and a2 are weight factors.

[0060] Define the measurement formula of system security index SO:

[0061] SO=k1F N ×k2I N =k1k2(CM-CM0) 2

[0062] Among them, F N represents the noise injection frequency, I N represents the noise injection intensity, CM0 is the baseline cache miss count when the system is operating normally, CM is the cache miss count monitored by the PerformanceCounter module, and k1 and k2 are scaling factors.

[0063] Define the measurement formula of system performance indicator PO:

[0064] PO=(w1CPU usage +w2MEM usage +w3IO wait )×g(F N ,I N )

[0065]

[0066] Among them, CPU usage MEM usage and IO wait is the performance indicator monitored by the Monitor module, w1, w2, and w3 are weight factors. Nonlinear function g(F N ,I N ) simulates the complex effect of noise injection on performance, k3 is the scaling factor, and a, b, c are nonlinear factors.

[0067] Step 44, improve the PSO algorithm and dynamically adjust the inertia weight and acceleration coefficient. The inertia weight gradually decreases from the maximum value w_max = 0.9 to the minimum value w_min = 0.4 as the number of iterations iteration_counter increases. Inertia weight calculation formula:

[0068]

[0069] The acceleration coefficient c1 gradually decreases from the maximum value c1_start = 2.5 to the minimum value c1_end = 1.5. The acceleration coefficient c2 gradually increases from the minimum value c2_start = 1.5 to the maximum value c2_end = 2.5. Acceleration coefficient calculation formula:

[0070]

[0071] Step 45, using the dynamically adjusted inertia weight and acceleration coefficient, updates the position and velocity of the particle according to the current optimal value.

[0072] Step 46, determine whether the maximum number of iterations MAX_ITER is reached, if yes, execute 47, otherwise execute 43.

[0073] Step 47, output the optimal noise injection strategy, output value F N , I N ∈{1,2,3,4,5,6,7,8,9,10}. And wake up the NoiseInjector module.

[0074] Figure 5 This is a schematic diagram of the NoiseInjector module workflow. Figure 5 As shown, including:

[0075] Step 51, set the noise injection parameters and convert the F output by the Manager module N and I N Converted into actual parameter values ​​F and I. When L = 1, F = 0.55-0.05F N , I=I N .

[0076] Step 52, allocate memory. When L=1, use malloc to allocate space twice the size of the L1 cache.

[0077] Step 53, estimate the number of cache misses CM introduced by the NoiseInjector module during the injection time t N :

[0078]

[0079] Step 54: Estimated value CMN Notify the PerformanceCounter module, so that the impact of the defense module can be eliminated during the next system threat monitoring.

[0080] Step 55, determining the access memory size according to I, and controlling the interval time according to F, that is, pre-fetching and accessing I blocks of memory every F milliseconds to generate noise.

[0081] Step 56, determine whether the injection time t is reached, if yes, end the injection, otherwise execute 55 to continue to complete the noise injection.

[0082] It should be understood that although this specification is described based on implementation methods, not every implementation method contains only one independent technical solution. This narrative method of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each implementation method may also be appropriately combined and implemented according to the understanding of those skilled in the art.

[0083] The series of detailed descriptions listed above are only specific descriptions of feasible implementation modes of the present invention. They are not used to limit the protection scope of the present invention. All equivalent implementation modes or changes that do not deviate from the spirit of the invention should be included in the protection scope of the present invention.

Claims

1. A cache covert communication defense method for ARM platform based on noise loading injection, characterized by: Based on the TrustZone architecture, a cache covert communication defense architecture based on noise loading injection is designed, which includes four modules: PerformanceCounter module, Monitor module, Manager module and NoiseInjector module; The PerformanceCounter module is used to dynamically monitor system threats caused by cache covert communication behaviors, identify potential abnormal behaviors, and initiate subsequent defense mechanisms when abnormalities are found, passing the cache status as a threat indicator to the NoiseInjector module; The Monitor module is used to dynamically monitor the performance of the defense module during the entire execution cycle of the defense module and feed it back to the NoiseInjector module as a performance indicator; The Manager module is used to generate the optimal noise injection strategy based on the cache covert communication threat fed back by the PerformanceCounter module and the system performance fed back by the Monitor module; The NoiseInjector module is used to implement noise injection based on cache loading; The cache covert communication defense architecture based on noise loading injection also includes a dynamic monitoring mechanism, a policy optimization mechanism, and a noise injection mechanism. The dynamic monitoring mechanism includes monitoring of system threats and system performance. For system threats, they are identified by monitoring the number of cache misses, because attack behaviors will cause an abnormal increase in the number of cache misses, and the size of the cache misses can also distinguish between normal behavior and attack behavior under high load. The number of cache misses is used as the indicator variable of system threats; the CPU occupancy rate, memory occupancy rate and I / O waiting time of the defense process are paid attention to to evaluate the consumption of system resources by the defense process; the strategy optimization mechanism is based on the PSO algorithm, and the threat indicator variables and performance indicator variables monitored in the dynamic monitoring mechanism are introduced to define an objective function to obtain the optimal noise injection strategy for the current system; and in order to meet the demand of real-time generation of the optimal strategy, the key parameters and mechanisms of the PSO algorithm are dynamically adjusted; the noise injection mechanism proposes a noise injection method based on cache loading to interfere with cache covert communication; for the two attack scenarios of single-core and cross-core cache covert communication, corresponding noise injection strategies are designed respectively; the noise injection strategy is quantified by two key parameters: noise injection frequency and noise injection intensity, which correspond to the injection time interval and the size of the loaded data respectively; in order to interfere with the cache status of different cache levels, combined with the different cache properties on the ARM platform, the ARM inline assembly instruction prfm is used to implement the pre-fetching of data blocks, and by directly controlling the data loading process, it is ensured that the target memory address is loaded into the specified cache level, so as to achieve effective defense against the two attack scenarios.

2. According to claim 1, a method for defending ARM platform cache covert communication based on noise loading injection is characterized in that: The execution flow of the PerformanceCounter module is as follows: Step 21, perform the counter initialization operation. The PerformanceCounter module creates two monitoring events to monitor the L1 and L2 cache miss events respectively; Step 22, perform the counter reset operation to clear the counters of the two monitoring events to 0; Step 23, perform the counter enabling operation to start counting for the above two counters; Step 24, wait for the measurement time, which is the set monitoring time period; Step 25, perform the counter disabling operation to stop counting for the two counters; Step 26, read the counter values and obtain the current measurement values CML1 and CML2 through the perf_event_open system call; Step 27, determine whether (CML1>CMBL1)&&(CML2>CMBL2) is satisfied. If it is satisfied, a cross-core cache attack is detected and Step 28 is executed; otherwise, Step 29 is executed; Step 28, calculate CM and L; CM = CML2, L = 2; Step 29, determine whether (CML1>CMBL1)&&(CML2<CMBL2) is satisfied. If it is satisfied, a single-core cache attack is detected and Step 30 is executed; if not, it means that no system threat has been detected yet, and Step 31 is executed; Step 210, calculate CM and L; CM = CML1, L = 1; Step 211, wait for the monitoring time, which represents the monitoring period of the dynamic monitoring mechanism, and then start the next dynamic monitoring of system threats; Step 212, when a system threat is detected, the PerformanceCounter module will wake up the Manager module and the Monitor module and pass the values of the two variables CM and L to the Manager module.

3. According to claim 1, a method for defending ARM platform cache covert communication based on noise loading injection is characterized in that: The execution process of the Monitor module is as follows: Step 31, initialize the performance indicator variable CPU usage , MEM usage and IO wait ; Among them, CPU usage Indicates the CPU usage of the defense process, reflecting the proportion of the process in the overall CPU usage of the system; MEM usage Indicates the memory usage of the defense process, reflecting the proportion of the process in the overall system memory usage; IO wait The system's I / O waiting time reflects the proportion of processor waiting caused by I / O operations in resource scheduling; Step 32, construct the top command to extract relevant measurement information, including the CPU occupancy rate, memory occupancy rate of the system and defense processes, and the I / O waiting time of the system; Step 33, execute the top command to obtain the above relevant measurement information; Step 34, parse the top command, read the command execution results line by line, and find the relevant measurement information; Step 35, calculate the performance indicator CPU usage , MEM usage and IO wait ; Among them, CPU usage and MEM usage is the ratio of the occupancy rate of the defense process to the occupancy rate of the entire system, IO wait Read directly from the execution result of the top instruction; Step 36: After the Monitor module obtains the performance indicator, it wakes up the Manager module and sets the performance indicator variable CPU usage , MEM usage and IO wait The calculated value is passed to the Manager module.

4. The ARM platform cache covert communication defense method based on noise loading injection according to claim 1 is characterized in that: The execution process of the Manager module is as follows: Step 41, set the basic parameters of the PSO algorithm, including the number of particles SWARM_SIZE and the maximum number of iterations MAX_ITER of the PSO; Step 42, dynamically calculate the noise injection frequency F N , noise injection intensity I N The search space of [min_bounds, max_bounds]; where F N ∈[0,min(CM / CM0,10],I N ∈[0,10]; Initialize the particle position and velocity in this space; Step 43, evaluate the particle fitness value using the constructed objective function; the objective function is composed of two functions, the system security index and the system performance index, weighted; SPB = -a1SO + a2PO where SO is the system security index, PO is the system performance index, and a1, a2 are weight factors; Define the measurement formula for the system security index SO: SO=k1F N ×k2I N =k1k2(CM-CM0) 2 Among them, F N represents the noise injection frequency, I N represents the noise injection intensity, CM0 is the baseline cache miss count when the system is operating normally, CM is the cache miss count monitored by the PerformanceCounter module, and k1 and k2 are scaling factors; Define the measurement formula for the system performance index PO: PO=(w1CPU usage +w2MEM usage +w3IO wait )×g(F N ,AND N ) Among them, CPU usage MEM usage and IO wait is the performance index monitored by the Monitor module, w1, w2, w3 are weight factors; the nonlinear function g(F N ,I N ) simulates the complex effect of noise injection on performance, k3 is the scaling factor, a, b, c are nonlinear factors; Step 44, improve the PSO algorithm and dynamically adjust the inertia weight and acceleration coefficient; the inertia weight decreases gradually from the maximum value w_max = 0.9 to the minimum value w_min = 0.4 as the number of iterations iteration_counter increases; the inertia weight calculation formula: The acceleration coefficient c1 gradually decreases from the maximum value c1_start = 2.5 to the minimum value c1_end = 1.5; the acceleration coefficient c2 gradually increases from the minimum value c2_start = 1.5 to the maximum value c2_end = 2.5; the acceleration coefficient calculation formula is: Step 45, using the dynamically adjusted inertia weight and acceleration coefficient, updating the position and velocity of the particle according to the current optimal value; Step 46, determine whether the maximum number of iterations MAX_ITER is reached, if yes, execute 47, otherwise execute 43; Step 47, output the optimal noise injection strategy, output value F N , I N ∈{1,2,3,4,5,6,7,8,9,10}; and wake up the NoiseInjector module.

5. According to claim 1, a method for defending ARM platform cache covert communication based on noise loading injection is characterized in that: The execution flow of the NoiseInjector module is as follows: Step 51, set the noise injection parameters and convert the F output by the Manager module N and I N Converted into actual parameter values ​​F and I; when L = 1, F = 0.55-0.05F N , I=I N ; Step 52, allocate memory. When L=1, use malloc to allocate twice the size of the L1 cache. Step 53, estimate the number of cache misses CM introduced by the NoiseInjector module during the injection time t N : Step 54: Estimated value CM N Notify the PerformanceCounter module, and then eliminate the impact of the defense module during the next system threat monitoring; Step 55, determining the access memory size according to I, and controlling the interval time according to F, that is, pre-fetching and accessing I blocks of memory every F milliseconds to generate noise; Step 56, determine whether the injection time t is reached, if yes, end the injection, otherwise execute 55 to continue to complete the noise injection.

Images