CacheShield：保护遗留进程免受缓存攻击
CacheShield: Protecting Legacy Processes Against Cache Attacks
摘要：
高速缓存攻击会对执行流或内存访问依赖于敏感信息的任何代码构成威胁。特别是在公共云中，缓存在多个租户之间共享，缓存攻击仍然是一个未解决的问题。缓存攻击依赖于间谍进程的驱逐，这会改变受害进程的执行行为。我们表明，硬件性能的加密例程事件揭示了缓存攻击的存在。基于这一观察，我们提出了CacheShield，一个工具来保护遗留代码，通过监视其执行和检测缓存攻击的存在，从而提供了采取预防措施的机会。CacheShield可以由用户运行，并且不需要更改操作系统或hypervisor，而以前提出的基于软件的对策需要hypervisor的合作。与试图检测恶意进程的方法不同，我们的方法是精益的，因为只有一小部分系统需要监控。它还可以很好地集成到当今的云基础设施中，因为相关用户可以选择使用CacheShield，而无需云服务提供商的支持。我们的研究结果表明，CacheShield检测缓存攻击速度快，可靠性高，误报率低，即使在存在强噪声。
英文摘要：
Cache attacks pose a threat to any code whose execution flow or memory accesses depend on sensitive information. Especially in public clouds, where caches are shared across several tenants, cache attacks remain an unsolved problem. Cache attacks rely on evictions by the spy process, which alter the execution behavior of the victim process. We show that hardware performance events of cryptographic routines reveal the presence of cache attacks. Based on this observation, we propose CacheShield, a tool to protect legacy code by monitoring its execution and detecting the presence of cache attacks, thus providing the opportunity to take preventative measures. CacheShield can be run by users and does not require alteration of the OS or hypervisor, while previously proposed software-based countermeasures require cooperation from the hypervisor. Unlike methods that try to detect malicious processes, our approach is lean, as only a fraction of the system needs to be monitored. It also integrates well into today's cloud infrastructure, as concerned users can opt to use CacheShield without support from the cloud service provider. Our results show that CacheShield detects cache attacks fast, with high reliability, and with few false positives, even in the presence of strong noise.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
