Fight Hardware with Hardware: System-wide Detection and Mitigation of Side-Channel Attacks using Performance Counters
Fuente:
arXiv
Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Preprint |
| Published: |
2024
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866916132981571584 |
|---|---|
| author | Carnà, Stefano Ferracci, Serena Quaglia, Francesco Pellegrini, Alessandro |
| author_facet | Carnà, Stefano Ferracci, Serena Quaglia, Francesco Pellegrini, Alessandro |
| contents | We present a kernel-level infrastructure that allows system-wide detection of malicious applications attempting to exploit cache-based side-channel attacks to break the process confinement enforced by standard operating systems. This infrastructure relies on hardware performance counters to collect information at runtime from all applications running on the machine. High-level detection metrics are derived from these measurements to maximize the likelihood of promptly detecting a malicious application. Our experimental assessment shows that we can catch a large family of side-channel attacks with a significantly reduced overhead. We also discuss countermeasures that can be enacted once a process is suspected of carrying out a side-channel attack to increase the overall tradeoff between the system's security level and the delivered performance under non-suspected process executions. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2402_13281 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Fight Hardware with Hardware: System-wide Detection and Mitigation of Side-Channel Attacks using Performance Counters Carnà, Stefano Ferracci, Serena Quaglia, Francesco Pellegrini, Alessandro Cryptography and Security Operating Systems We present a kernel-level infrastructure that allows system-wide detection of malicious applications attempting to exploit cache-based side-channel attacks to break the process confinement enforced by standard operating systems. This infrastructure relies on hardware performance counters to collect information at runtime from all applications running on the machine. High-level detection metrics are derived from these measurements to maximize the likelihood of promptly detecting a malicious application. Our experimental assessment shows that we can catch a large family of side-channel attacks with a significantly reduced overhead. We also discuss countermeasures that can be enacted once a process is suspected of carrying out a side-channel attack to increase the overall tradeoff between the system's security level and the delivered performance under non-suspected process executions. |
| title | Fight Hardware with Hardware: System-wide Detection and Mitigation of Side-Channel Attacks using Performance Counters |
| topic | Cryptography and Security Operating Systems |
| url | https://arxiv.org/abs/2402.13281 |