A method for preventing covert communication in ARM platform caches based on noise loading injection

Abstract

This invention discloses a method for defending against cached covert communication on an ARM platform based on noise loading injection. Due to the expanding attack surface of TEEs and the vulnerabilities of TrustZone technology in microarchitectural isolation, cached covert communication has become possible. This invention adds a defense mechanism against cached covert communication based on TrustZone technology, designing a cached covert communication defense architecture based on noise loading injection. Based on this architecture, a dynamic monitoring mechanism, a strategy optimization mechanism, and a noise injection mechanism are proposed. The dynamic monitoring mechanism monitors system security and system performance. The strategy optimization mechanism generates the optimal noise injection strategy and calculates the noise injection frequency and intensity in real time. The noise injection mechanism loads data to resist cached covert communication. This defense method improves the security of the original architecture and achieves low performance overhead, balancing system security and performance.

Description

Technical Field

[0001] This invention relates to a method for defending against ARM platform cache covert communication based on noise loading injection in the field of ARM platform security. Background Technology

[0002] ARM-based embedded systems have introduced TrustZone technology to enhance system security. TrustZone provides an isolated Trusted Execution Environment (TEE) through hardware expansion for deploying Trusted Applications (TAs). However, TrustZone technology faces two significant challenges: 1) As TAs become more complex, the attack surface of the TEE expands. Any vulnerable or malicious TA could potentially be controlled by an attacker in the normal execution environment (REE), thereby compromising system security. 2) TrustZone does not provide secure isolation for microarchitectural resources (such as caches) between the two worlds. Applications in the normal world (CAs) can manipulate and speculate on the cache state in the secure world through the cache, enabling cache-based covert cross-world communication.

[0003] Therefore, due to the existence of a controlled TA, if it sends secret information to an attacker in the REE via a cache, sensitive data (such as keys) in the TEE can be leaked. This cache-based, cross-world covert channel established from a controlled TA breaks through TrustZone's isolation mechanism, thus threatening the security of the entire system.

[0004] To defend against cache covert communication on ARM platforms, existing research has proposed hardware, software, and combined hardware / software defense schemes. Hardware solutions aim to enhance resource isolation within TrustZone by proposing new cache architectures to prevent covert communication between the two worlds via the cache. However, hardware modifications are difficult to deploy on most platforms. Combined hardware / software solutions attempt to enhance isolation between TAs by creating strongly isolated compartments within the REE or TEE and refreshing the cache state upon entering and leaving these compartments, preventing even controlled TAs from leaking information through the cache. However, this approach introduces significant overhead due to the large number and frequency of cache refreshes, severely impacting system performance. Software solutions primarily rely on noise injection methods based on cache refresh. While introducing less overhead, they fail to adequately consider various cache attack patterns and are ill-equipped to counter various known cache covert communication techniques.

[0005] The noise-based loading injection method employs a software architecture that can be easily deployed in the TrustZone environment on the ARM platform. Compared to the cache-flush noise injection method, it introduces less overhead and, through control of the injection frequency and intensity, can better defend against various known communication technologies.

[0006] In summary, the noise-load injection-based ARM platform cache covert communication defense method of this invention can further meet the security world isolation requirements of the ARM TrustZone architecture. Addressing the vulnerability of the current architecture to cache covert communication threats, it proposes new ideas and approaches to enhance the security of the existing architecture. Therefore, this invention proposes a noise-load injection-based ARM platform cache covert communication defense method. Summary of the Invention

[0007] To prevent sensitive information from leaking from TEE through cached covert communication and further enhance TEE security, this invention adds a defense mechanism against cached covert communication based on TrustZone technology, and proposes a cached covert communication defense method for ARM platform based on noise loading injection.

[0008] To achieve the objectives of this invention, a cache-based covert communication defense architecture based on noise loading injection is designed, comprising four defense modules: PerformanceCounter, Monitor, Manager, and NoiseInjector. Based on this architecture, this invention proposes a dynamic monitoring mechanism, a strategy optimization mechanism, and a noise injection mechanism. The dynamic monitoring mechanism monitors system security and performance. The strategy optimization mechanism generates an optimal noise injection strategy to balance system security and performance. The noise injection mechanism effectively defends against cache-based covert communication.

[0009] A defense architecture based on noise-injected cached communication. This architecture comprises four modules: PerformanceCounter, Monitor, Manager, and NoiseInjector.

[0010] 1. PerformanceCounter Module. The PerformanceCounter module is located in REE. Its purpose is to dynamically monitor system threats caused by cached covert communication, identify potential abnormal behaviors, and initiate subsequent defense mechanisms when an anomaly is detected. The cache status is passed as a threat indicator to the NoiseInjector module.

[0011] 2. Monitor Module. The Monitor module is located in REE. Its function is to dynamically monitor the performance of the defense module throughout its execution cycle and feed it back as a performance indicator to the NoiseInjector module.

[0012] 3. Manager Module. The Manager module is located in REE. Its function is to generate the optimal noise injection strategy based on the cached covert communication threats reported by the PerformanceCounter module and the system performance reported by the Monitor module.

[0013] 4. The NoiseInjector module. The NoiseInjector module is located in REE, and its function is to implement noise injection based on cache loading.

[0014] Dynamic monitoring mechanism. The dynamic monitoring mechanism includes monitoring system threats and system performance. For system threats, this invention identifies them by monitoring cache misses, because attack behavior often leads to an abnormal increase in cache misses, and the magnitude of cache misses can effectively distinguish normal behavior under high load (such as stress instructions) from attack behavior. Therefore, this invention uses cache misses as the main indicator variable for system threats. For system performance, this invention focuses on the CPU utilization and memory utilization of the defense process, as well as the system's I / O wait time, to assess the consumption of system resources by the defense process.

[0015] Strategy optimization mechanism. To balance system security and performance overhead, this invention, based on the PSO algorithm, introduces threat indicator variables and performance indicator variables from a dynamic monitoring mechanism, defining an objective function to obtain the optimal noise injection strategy for the current system. Furthermore, to meet the requirement of real-time generation of the optimal strategy, key parameters and mechanisms of the PSO algorithm are dynamically adjusted to improve optimization performance, accelerate convergence, and find the optimal solution more quickly.

[0016] Noise Injection Mechanism. This invention proposes a noise injection method based on cache loading to interfere with potential cache covert communication. For two attack scenarios—single-core and cross-core cache covert communication—this invention designs corresponding noise injection strategies. The noise injection strategy is quantified by two key parameters: noise injection frequency and noise injection intensity, corresponding to the injection time interval and the size of the loaded data, respectively. Furthermore, to interfere with the cache states of different cache levels, this invention combines different cache attributes on the ARM platform (such as inclusive and non-inclusive) and uses the ARM inline assembly instruction `prfm` to prefetch data blocks. By directly controlling the data loading process, it ensures that the target memory address is loaded into the specified cache level (such as L1 or L2), achieving effective defense against both attack scenarios.

[0017] This invention proposes a method for defending against cached covert communication on the ARM platform based on noise loading injection. Building upon the ARMTrustZone architecture, a defense module against cached covert communication is added. A dynamic monitoring mechanism, a strategy optimization mechanism, and a noise injection mechanism are proposed, improving the security of the original architecture while achieving low performance overhead, thus balancing system security and performance. Attached Figure Description

[0018] Figure 1 This is a schematic diagram of the overall architecture of the present invention.

[0019] Figure 2 This is a schematic diagram of the workflow of the PerformanceCounter module of this invention.

[0020] Figure 3 This is a schematic diagram of the workflow of the Monitor module of the present invention.

[0021] Figure 4 This is a schematic diagram of the workflow of the Manager module of this invention.

[0022] Figure 5 This is a schematic diagram of the workflow of the NoiseInjector module of this invention. Detailed Implementation

[0023] The present invention will now be described in detail with reference to the specific embodiments shown in the accompanying drawings.

[0024] Figure 1 This is the overall architecture diagram of the ARM platform cache covert communication defense method based on noise loading injection, as described in this invention. Figure 1 As shown.

[0025] This invention deploys a defense module against cached covert communication on the REE, including four modules: PerformanceCounter, Monitor, Manager, and NoiseInjector.

[0026] 1. PerformanceCounter Module. The PerformanceCounter module is designed to dynamically monitor system threats caused by cached covert communications, identify potential abnormal behaviors, and initiate subsequent defense mechanisms when anomalies are detected.

[0027] 2. Monitor Module. The Monitor module is used to dynamically monitor the performance of the defense module throughout its execution cycle.

[0028] 3. Manager Module. The Manager module is responsible for generating the optimal noise injection strategy based on the improved PSO algorithm.

[0029] 4. The NoiseInjector module. The NoiseInjector module is responsible for implementing noise injection based on cache loading.

[0030] In this architecture, the PerformanceCounter module, as the scheduling module of the entire defense process, monitors the system's cache usage in real time (1). By dynamically analyzing the cache status, the PerformanceCounter module can identify potential abnormal behaviors and initiate a defense mechanism when an anomaly is detected, passing the cache status as a threat indicator to the Manager module (2). The Monitor module monitors the system performance in real time throughout the entire cycle of the defense process (3) and feeds back the system performance indicators to the Manager module (4). The Manager module, as the core module of the entire defense process, uses the improved PSO algorithm to generate the optimal noise injection strategy for the current covert communication threat and system performance, and passes the strategy to the NoiseInjector module (5). The NoiseInjector module implements the defense against covert communication during the cache injection process (6). The defense architecture of this invention can effectively disrupt covert communication, making it difficult for attackers to obtain effective information through execution time or PMU, and achieving effective defense against covert communication in a constantly changing threat environment. In addition, the optimized noise injection strategy also enables the system to maintain high security without significantly affecting overall performance, achieving a balance between system security and performance.

[0031] Figure 2 This is a flowchart illustrating the workflow of the PerformanceCounter module, as follows: Figure 2 As shown.

[0032] To describe the dynamic monitoring mechanism for system threats, the monitored count values ​​are first formally described as follows:

[0033] The monitored counts are defined as CML1 and CML2. CML1 represents the measured number of L1 cache misses, and CML2 represents the measured number of L2 cache misses. Standard thresholds are defined as CMBL1 and CMBL2. CMBL1 and CMBL2 represent the baseline values ​​for L1 and L2 cache misses, respectively. When a system threat is detected, CM and L are defined as system threat indicator variables. CM represents the level of system threat (CM = CML1||CML2), and L represents the detected attack scenario (L = 1||2), where 1 represents a single-core attack, which will inject noise into the L1 cache, and 2 represents a cross-core attack, which will inject noise into the L2 cache.

[0034] The working process of the PerformanceCounter module is described in detail below according to the above formal language description:

[0035] Step 21, counter initialization operation. The PerformanceCounter module creates two monitoring events to monitor the L1 and L2 cache miss events respectively.

[0036] Step 22, counter reset operation. Clear the counters of the two monitoring events to 0.

[0037] Step 23, counter enable operation. Start counting for the above two counters.

[0038] Step 24, wait for the measurement time, which is the set monitoring time period.

[0039] Step 25, counter disable operation. Stop counting for the above two counters.

[0040] Step 26, read the counter values. Obtain the measurement values CML1 and CML2 this time through the perf_event_open system call.

[0041] Step 27, determine whether (CML1>CMBL1) && (CML2>CMBL2) is satisfied. If it is satisfied, a cross-core cache attack is detected, and step 28 is executed; otherwise, step 29 is executed.

[0042] Step 28, calculate CM and L. CM = CML2, L = 2.

[0043] Step 29, determine whether (CML1>CMBL1) && (CML2<CMBL2) is satisfied. If it is satisfied, a single-core cache attack is detected, and step 210 is executed. If it is not satisfied, it means that no system threat has been detected yet, and step 211 is executed.

[0044] Step 210, calculate CM and L. CM = CML1, L = 1.

[0045] Step 211, wait for the monitoring time, which represents the monitoring period of the dynamic monitoring mechanism, and then start the next dynamic monitoring of system threats.

[0046] Step 212, when a system threat is detected, the PerformanceCounter module will wake up the Manager module and the Monitor module, and pass the values of the two variables CM and L to the Manager module.

[0047] Figure 3 It is a schematic diagram of the working process of the Monitor module. As Figure 3 shown, it includes:

[0048] Step 31, Initialize the performance metric variable CPU usage MEM usage and IO wait Among them, CPU usage This indicates the CPU utilization of the defense process, reflecting the proportion of that process in the overall system CPU usage. MEM usage This indicates the memory usage of the defense process, reflecting its proportion of the overall system memory usage. (IO) wait The system's I / O wait time is reflected in the proportion of processor wait time caused by I / O operations during resource scheduling.

[0049] Step 32: Construct the top command to extract relevant measurement information, including the CPU utilization, memory utilization, and I / O wait time of the system and defense processes.

[0050] Step 33: Execute the top command to obtain the relevant measurement information mentioned above.

[0051] Step 34: Parse the top command, read the command execution results line by line, and find relevant measurement information.

[0052] Step 35, Calculate CPU performance metrics usage MEM usage and IO wait Among them, CPU usage and MEM usage The ratio of the utilization rate of the defense process to the overall system utilization rate, IO wait It can be read directly from the execution result of the top command.

[0053] Step 36: After the Monitor module obtains the performance metrics, it will wake up the Manager module and set the performance metric variable CPU... usage MEM usage and IO wait The calculated value is passed to the Manager module.

[0054] Figure 4 This is a schematic diagram of the workflow of the Manager module of this invention, as follows: Figure 4 As shown, it includes:

[0055] Step 41: Set the basic parameters of the PSO algorithm, including the number of particles SWARM_SIZE and the maximum number of iterations MAX_ITER.

[0056] Step 42, dynamically calculate the noise injection frequency F N Noise injection intensity I N The search space is [min_bounds, max_bounds]. Where F...N ∈[0,min(CM / CM0,10],I N ∈[0,10]. Initialize particle position (noise injection frequency) and velocity (noise injection intensity) within this space.

[0057] Step 43: Evaluate the particle fitness value using the constructed objective function. The objective function is a weighted sum of two functions: a system safety metric and a system performance metric.

[0058] SPB = -a1SO + a2PO

[0059] Where SO is the system security index, PO is the system performance index, and a1 and a2 are weighting factors.

[0060] Define the formula for measuring the system safety index SO:

[0061] SO=k1F N ×k2I N =k1k2(CM-CM0) 2

[0062] Among them, F N Indicates the noise injection frequency, I N The noise injection intensity is represented by CM0, which is the baseline cache miss count during normal system operation, CM is the cache miss count monitored by the PerformanceCounter module, and k1 and k2 are scaling factors.

[0063] Define the formula for measuring the system performance index PO:

[0064] PO = (w1CPU) usage +w2MEM usage +w3IO wait )×g(F N ,I N )

[0065]

[0066] Among them, CPU usage MEM usage and IO wait The Monitor module monitors performance metrics, with w1, w2, and w3 as weighting factors. The nonlinear function g(F) is used. N ,I N The complex impact of noise injection on performance is simulated, where k3 is a scaling factor and a, b, and c are nonlinear factors.

[0067] Step 44: Improve the PSO algorithm by dynamically adjusting the inertia weight and acceleration coefficient. Specifically, the inertia weight gradually decreases from a maximum value w_max = 0.9 to a minimum value w_min = 0.4 as the iteration number (iteration_counter) increases. The inertia weight calculation formula is as follows:

[0068]

[0069] The acceleration coefficient c1 gradually decreases from its maximum value c1_start = 2.5 to its minimum value c1_end = 1.5. The acceleration coefficient c2 gradually increases from its minimum value c2_start = 1.5 to its maximum value c2_end = 2.5. Acceleration coefficient calculation formula:

[0070]

[0071] Step 45: Using dynamically adjusted inertia weights and acceleration coefficients, update the particle's position and velocity based on the current optimal values.

[0072] Step 46: Determine if the maximum number of generations selected (MAX_ITER) has been reached. If yes, proceed to step 47; otherwise, proceed to step 43.

[0073] Step 47: Output the optimal noise injection strategy, output value F N I N ∈{1,2,3,4,5,6,7,8,9,10}. And wake up the NoiseInjector module.

[0074] Figure 5 This is a flowchart illustrating the workflow of the NoiseInjector module, as follows: Figure 5 As shown, it includes:

[0075] Step 51, set the noise injection parameters, and inject the F output from the Manager module. N and I N This is converted into actual parameter values ​​F and I. When L = 1, F = 0.55 - 0.05F N , I = I N .

[0076] Step 52: Allocate memory. When L=1, use malloc to allocate space twice the size of the L1 cache.

[0077] Step 53: Estimate the number of cache misses (CM) introduced by the NoiseInjector module within injection time t. N :

[0078]

[0079] Step 54, estimate the value CMN Notifying the PerformanceCounter module will eliminate the impact of the defense module during the next system threat monitoring.

[0080] Step 55: Determine the memory access size based on I, and control the interval time based on F, that is, prefetch I blocks of memory every F milliseconds to generate noise.

[0081] Step 56: Determine if the injection time t has been reached. If so, end the injection; otherwise, execute step 55 to continue the noise injection.

[0082] It should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This way of describing the specification is only for clarity. Those skilled in the art should regard the specification as a whole, and the technical solutions in various embodiments can also be appropriately combined and implemented according to the understanding of those skilled in the art.

[0083] The detailed descriptions listed above are merely specific descriptions of feasible embodiments of the present invention and are not intended to limit the scope of protection of the present invention. All equivalent embodiments or modifications made without departing from the spirit of the inventive technique should be included within the scope of protection of the present invention.

Claims

1. A method for defending against covert communication in ARM platform caches based on noise loading injection, characterized in that: Based on the TrustZone architecture, a cached covert communication defense architecture based on noise loading injection is designed, which includes four modules: PerformanceCounter, Monitor, Manager and NoiseInjector. The PerformanceCounter module is used to dynamically monitor system threats caused by hidden communication behavior in the cache, identify potential abnormal behaviors, and initiate subsequent defense mechanisms when an anomaly is detected, passing the cache status as a threat indicator to the NoiseInjector module. The Monitor module is used to dynamically monitor the performance of the defense module throughout its execution cycle and feed it back to the NoiseInjector module as a performance indicator. The Manager module is used to generate the optimal noise injection strategy based on the cached covert communication threats reported by the PerformanceCounter module and the system performance reported by the Monitor module. The NoiseInjector module is used to implement noise injection based on cache loading; The cache covert communication defense architecture based on noise loading injection also includes a dynamic monitoring mechanism, a policy optimization mechanism, and a noise injection mechanism. Among them, the dynamic monitoring mechanism includes monitoring system threats and system performance. For system threats, they are identified by monitoring the number of cache misses, because attack behavior will cause the number of cache misses to rise abnormally, and the size of the number of cache misses can also distinguish between normal behavior and attack behavior under high load. The number of cache misses is used as an indicator variable of system threat. The CPU utilization, memory utilization, and I / O wait time of the defense process are monitored to assess the resource consumption of the defense process. The strategy optimization mechanism is based on the PSO algorithm, incorporating the threat and performance indicators monitored in the dynamic monitoring mechanism. An objective function is defined to obtain the optimal noise injection strategy for the current system. To meet the requirement of real-time generation of the optimal strategy, the key parameters and mechanisms of the PSO algorithm are dynamically adjusted. A noise injection mechanism based on cache loading is proposed to interfere with cache covert communication. Corresponding noise injection strategies are designed for single-core and cross-core cache covert communication attack scenarios. The noise injection strategy is quantified by two key parameters: noise injection frequency and noise injection intensity, corresponding to the injection time interval and the size of the loaded data, respectively. To interfere with the cache states of different cache levels, the inline assembly instruction prfm of ARM is used to prefetch data blocks, taking into account the different cache attributes on the ARM platform. By directly controlling the data loading process, the target memory address is ensured to be loaded into the specified cache level, achieving effective defense against both attack scenarios.

2. The method for defending against covert communication in an ARM platform cache based on noise loading injection as described in claim 1, characterized in that: The execution flow of the PerformanceCounter module is as follows: Step 21, counter initialization operation: The PerformanceCounter module creates two monitoring events to monitor L1 and L2 cache miss events respectively; Step 22, counter reset operation, clear the counters of the two monitored events to 0; Step 23: Counter activation operation, start the counting of the two counters mentioned above; Step 24, wait for the measurement time, which is the set monitoring time period; Step 25, Counter Disabling Operation: Turn off the counting of both counters; Step 26: Read the count value and obtain the measurement values ​​CML1 and CML2 using the perf_event_open system call; Step 27: Determine whether (CML1 > CMBL1) && (CML2 > CMBL2) is satisfied. If satisfied, a cross-core cache attack is detected, and step 28 is executed; otherwise, step 29 is executed. CMBL1 represents the baseline value of the number of L1 cache misses, and CMBL2 represents the baseline value of the number of L2 cache misses. Step 28, calculate CM and L; CM = CML², L = 2; Step 29: Determine if (CML1 > CMBL1) && (CML2 < CMBL2) is satisfied. If satisfied, a single-core cache attack is detected, and proceed to step 30. If not satisfied, it means that no system threat has been detected yet, and proceed to step 31. Step 210, calculate CM, L; CM = CML1, L = 1; Step 211, waiting for monitoring time, represents the monitoring cycle of the dynamic monitoring mechanism, after which the next dynamic monitoring of system threats will begin; Step 212: When a system threat is detected, the PerformanceCounter module will wake up the Manager module and the Monitor module, and pass the values ​​of the two variables CM and L to the Manager module.

3. The method for defending against covert communication in an ARM platform cache based on noise loading injection as described in claim 1, characterized in that: The execution flow of the Monitor module is as follows: Step 31, Initialize the performance metric variable CPU usage MEM usage and IO wait ; Among them, CPU usage The CPU utilization of the defense process represents the proportion of that process in the overall system CPU usage; MEM usage This indicates the memory usage of the defense process, reflecting its proportion of the overall system memory usage; IO wait The system's I / O latency reflects the proportion of processor wait time caused by I / O operations in resource scheduling; Step 32: Construct the top command to extract relevant measurement information, including the CPU utilization, memory utilization, and I / O wait time of the system and defense processes; Step 33: Execute the top command to obtain the relevant measurement information mentioned above; Step 34: Parse the top command, read the command execution results line by line, and find relevant measurement information; Step 35, Calculate CPU performance metrics usage MEM usage and IO wait Among them, CPU usage and MEM usage The ratio of the utilization rate of the defense process to the overall system utilization rate, IO wait Read directly from the execution result of the top command; Step 36: After the Monitor module obtains the performance metrics, it will wake up the Manager module and set the performance metric variable CPU... usage MEM usage and IO wait The calculated value is passed to the Manager module.

4. The method for defending against covert communication in an ARM platform cache based on noise loading injection as described in claim 1, characterized in that: The execution flow of the Manager module is as follows: Step 41: Set the basic parameters of the PSO algorithm, including the number of particles SWARM_SIZE and the maximum number of iterations MAX_ITER; Step 42, dynamically calculate the noise injection frequency F N Noise injection intensity I N The search space is [min_bounds, max_bounds]; where F N ∈[0, min(CM / CM0, 10],I N ∈[0, 10]; Initialize particle position and velocity within this space; Step 43: Evaluate particle fitness values ​​using the constructed objective function; the objective function is a weighted sum of two functions: system safety index and system performance index. ； Where SO is the system security index, PO is the system performance index, and a1 and a2 are weighting factors. Define the formula for measuring the system safety index SO: ； Among them, F N Indicates the noise injection frequency, I N The noise injection intensity is represented by CM0, which is the baseline cache miss count during normal system operation, CM is the cache miss count monitored by the PerformanceCounter module, and k1 and k2 are scaling factors. Define the formula for measuring the system performance index PO: ； ； Among them, CPU usage MEM usage and IO wait The Monitor module monitors performance metrics, where w1, w2, and w3 are weighting factors; the nonlinear function g(F) is used. N , I N The complex impact of noise injection on performance is simulated, where k3 is a scaling factor and a, b, and c are nonlinear factors. Step 44: Improve the PSO algorithm by dynamically adjusting the inertia weight and acceleration coefficient. The inertia weight gradually decreases from a maximum value w_max = 0.9 to a minimum value w_min = 0.4 as the iteration number (iteration_counter) increases. The inertia weight calculation formula is as follows: ； The acceleration coefficient c1 gradually decreases from its maximum value c1_start = 2.5 to its minimum value c1_end = 1.5; the acceleration coefficient c2 gradually increases from its minimum value c2_start = 1.5 to its maximum value c2_end = 2.5; the acceleration coefficient calculation formula is as follows: ； ； Step 45: Using dynamically adjusted inertia weights and acceleration coefficients, update the particle's position and velocity based on the current optimal values; Step 46: Determine if the maximum number of generations selected (MAX_ITER) has been reached. If yes, proceed to step 47; otherwise, proceed to step 43. Step 47: Output the optimal noise injection strategy, output value F N I N ∈{1, 2, 3, 4, 5, 6, 7, 8, 9, 10}; and wake up the NoiseInjector module.

5. The method for defending against covert communication in an ARM platform cache based on noise loading injection as described in claim 1, characterized in that: The execution flow of the NoiseInjector module is as follows: Step 51, set the noise injection parameters, and inject the F output from the Manager module. N and I N Converted to actual parameter values ​​F and I; when L = 1, F = 0.55 − 0.05F N , I = I N ; Step 52: Allocate memory. When L = 1, use malloc to allocate space twice the size of the L1 cache. Step 53: Estimate the number of cache misses (CM) introduced by the NoiseInjector module within injection time t. N : ； Step 54, estimate the value CM N If the PerformanceCounter module is notified, the impact of the defense module will be excluded during the next system threat monitoring. Step 55: Determine the memory access size based on I, and control the interval time based on F, that is, prefetch I blocks of memory every F milliseconds to generate noise; Step 56: Determine if the injection time t has been reached. If so, end the injection; otherwise, execute step 55 to continue the noise injection.

Images