Cache Side-Channel Attack Detection Using Timer Thread
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current technologies are inadequate in detecting and preventing side-channel attacks that exploit shared cache resources in CPUs, particularly in environments where trusted timers or performance counters are not available, such as in trusted execution environments (TEEs).
Innovation Solution
A method utilizing a timer thread that continuously increments a variable to infer the time taken for code execution and determine cache misses, with a machine-learning classifier analyzing these misses to detect cache-based side-channel attacks, implemented without relying on operating system services like trusted timers or performance counters.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional detection methods using trusted timers or performance counters are used, then detection accuracy is improved, but availability is worsened because these services are not available in trusted execution environments
Solution Approach 1:
The patent introduces an intermediary mechanism - a timer thread that continuously increments a variable in memory - to bridge the gap between the need for timing information and the unavailability of traditional timer services in TEEs. This intermediary provides the necessary timing data without requiring external trusted services, thereby resolving the contradiction between detection accuracy and availability in restricted environments.
Solution Approach 2:
The system implements self-service by having the application instrumented with code that directly reads the timer variable and computes cache miss counts without external assistance. The application serves its own timing and detection needs through instrumented code that autonomously measures execution time and determines cache behavior, eliminating dependency on external trusted timer services.
2Reliability
If instrumented code is added to measure execution time and determine cache misses, then detection capability is improved, but device complexity is worsened
Solution Approach 1:
The patent segments the detection functionality into distinct components: a timer thread that increments the time variable, instrumented code that reads the timer and determines cache misses, and a classifier that analyzes the cache miss count. This segmentation allows each component to remain simple while the overall system achieves sophisticated detection capability, resolving the contradiction between reliability and complexity.
3Reliability
If the system monitors cache access patterns to detect attacks, then security is improved, but loss of time is worsened due to continuous monitoring overhead
Solution Approach 1:
The system uses periodic action by having the timer thread continuously increment the time variable at regular intervals while the application executes. This periodic ticking provides continuous monitoring capability without requiring active intervention or complex monitoring logic, thereby maintaining security while minimizing time overhead through simple, regular updates.
Data Source
AI summary
A method for detecting a cache-based side-channel attack includes utilizing a timer thread that continuously increments a variable in code of an application. The code has been instrumented such that the instrumented code uses the variable incremented by the timer thread to infer an amount of time taken for running a part of the code. A number of cache misses during execution of the part of the code is determined based on the amount of time. It is determined whether the application is experiencing the cache-based side-channel attack using a classifier which uses as input the number of cache misses.