A survey of microarchitectural timing attacks and countermeasures on contemporary hardware

By Qian Ge, Yuval Yarom, David A. Cock, Gernot Heiser. Journal of Cryptographic Engineering, 2016

446 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Electrical and Electronic Engineering, Hardware and Architecture

View Paper: https://www.semanticscholar.org/paper/ef7e005c41ec8547d70af67b608ccb6ba9982a0e

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Electrical and Electronic Engineering

In Hardware and Architecture

Citations in the corpus

Meltdown: Reading Kernel Memory from User Space (2018, background): “Thus, the microarchitectural state of the processor depends on prior software execution and affects its future behavior, creating the potential for untraditional communication channels [2].”
ZombieLoad: Cross-Privilege-Boundary Data Sampling (2019, background): “SGX, the kernel, and the hypervisor, these are somewhat artificial scenarios. Moreover, there are various covert channels available to user-space applications for stealthy inter-process communication [17, 51]. For VMs, however, there are not many known covert channels which can be used between two V”
Context-Sensitive Fencing: Securing Speculative Execution via Microcode Customization (2019, background): “mizations such as caches, branch speculation, memory disambiguation, and even DVFS, through side-channels such as memory bus activity [4], power consumption characteristics [8], branch access patterns [2, 29], faults [47, 40], acoustics [33, 32], electromagnetic effects [30], functional unit timing ”
CacheZoom: How SGX Amplifies The Power of Cache Attacks (2017, background): “…the content of static binary on the disk, observe which symmetric cipher and implementation is used, and identify offset of tables that static data from the victim binary will occupy.3 Although the attacker can observe the binary, she has no knowledge of the cipher key used during the encryption.”
A Systematic Evaluation of Transient Execution Attacks and Defenses (2018, background): “The corresponding microarchitectural elements are not shared among physical cores [21], but some are shared across logical cores [60].”
Keystone: an open framework for architecting trusted execution environments (2020, methodology): “Programmers should use existing software solutions to mask timing channels [42] and hardware manufacturers can supply timing side-channel resistant hardware [54].”
Malware Guard Extension: Using SGX to Conceal Cache Attacks (2017, background): “Consequently, researchers have demonstrated various side-channel attacks, especially those exploiting the cache [1].”
Spectre Attacks: Exploiting Speculative Execution (2018, background): “may result in unintended information leaks from one program to another [13].”
Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing (2016, background): “[14] conducted a comprehensive survey of microarchitectural side channels.”