The application provides a high-efficiency
covert channel attack and
information leakage method based on multiple interrupt driving, which is called Compound-INT. Four stable and controllable interrupt types (rtc0, PMI (Performance Monitor Interrupts), MCP (
Machine Check Polls), IWI (IRQ Work Interrupts), and TLB (TLB shootdowns)) are screened out by analyzing the / proc / interrupts interface in an
operating system to construct an efficient
covert channel. The method supports two transmission
modes, single bit and multi-bit. Single bit realizes data coding by controlling the interrupt triggering frequency, and multi-bit combines synchronous and asynchronous transmission
modes to improve bandwidth and anti-interference, and adapt to the complex conditions of a multi-core environment. In addition, the application realizes the leakage of the existence state of a target file in a restricted
directory by using the PMI interrupt, and speculates the structure information of a deep neural network (DNN) model by using the TLB shootdowns interrupt mode, thereby expanding the application scenarios of the
covert channel. Experimental results show that the method has
high transmission rate, low error rate and strong robustness, and provides a new idea for the security research of the interrupt mechanism of an
operating system.