DAWG: A Defense Against Cache Timing Attacks in Speculative Execution Processors
By Vladimir Kiriansky, Ilia A. Lebedev, Saman P. Amarasinghe, Srini Devadas, Joel S. Emer. Micro, 2018
321 citations recorded by the source corpus.
Software side channel attacks have become a serious concern with the recent rash of attacks on speculative processor architectures. Most attacks that have been demonstrated exploit the cache tag state as their exfiltration channel. While many existing defense mechanisms that can be implemented solely in software have been proposed, these mechanisms appear to patch specific attacks, and can be circumvented. In this paper, we propose minimal modifications to hardware to defend against a broad class of attacks, including those based on speculation, with the goal of eliminating the entire attack surface associated with the cache state covert channel. We propose DAWG, Dynamically Allocated Way Guard, a generic mechanism for secure way partitioning of set associative structures including memory caches. DAWG endows a set associative structure with a notion of protection domains to provide strong isolation. When applied to a cache, unlike existing quality of service mechanisms such as Intel's Cache Allocation Technology (CAT), DAWG fully isolates hits, misses, and metadata updates across protection domains. We describe how DAWG can be implemented on a processor with minimal modifications to modern operating systems. We describe a non-interference property that is orthogonal to speculative execution and therefore argue that existing attacks such as Spectre Variant 1 and 2 will not work on a system equipped with DAWG. Finally, we evaluate the performance impact of DAWG on the cache subsystem.
Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Hardware and Architecture
View Paper: https://www.semanticscholar.org/paper/35bc6bdabe200a411b12f3f11d612f6d722ec207
How researchers see this paper
The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.
In Artificial Intelligence
- Dawn Song
- Krste Asanovic
- David Kohlbrenner
- Shweta Shinde
- Dayeol Lee
- Nicholas Carlini
- Neil Zhenqiang Gong
- Bo Li
In Electrical and Electronic Engineering
In Hardware and Architecture
Citations in the corpus
- Keystone: an open framework for architecting trusted execution environments (2020, methodology): “Keystone can re-use known cache side-channel defenses [24, 54] as we demonstrated in Section 4.”
- Packet Chasing: Spying on Network Packets over a Cache Side-Channel (2019, unknown): “These mitigation strategies include identifying the leakage in software [48], observing anamalous cache behavior [49], [56], closing channels at hardware design time [41]–[45], dynamic cache partitioning [45], [46], [50], strictly reserving physical cores to security-sensitive threads [51], randomiz”