商用处理器中滥用Cache行脏状态泄漏信息
Abusing Cache Line Dirty States to Leak Information in Commercial Processors
摘要：
高速缓存已被用于构建各种类型的隐蔽和侧通道来泄漏信息。大多数现有的高速缓存通道利用高速缓存命中和高速缓存未命中之间的定时差。然而，我们引入了一个新的和更广泛的分类缓存隐蔽通道攻击：命中+未命中，命中+命中，和未命中+未命中。我们强调，在不同的状态下，高速缓存线的高速缓存未命中可能有更显着的时间差，这些可以被用作定时通道。基于这种分类，我们提出了一种新的稳定和隐形的Miss+Miss缓存通道。写回高速缓存广泛部署在现代处理器中。本文详细介绍了一种方法，在该方法中，可以使用替换延迟差异来构建基于时间的通道（称为WB通道），以泄漏回写缓存中的信息。发送方对高速缓存行的任何修改都将其设置为脏状态，并且接收方可以通过测量替换该高速缓存集的延迟来观察这一点。我们还演示了如何利用缓存集中不同数量的脏缓存行，以提高传输带宽的符号编码多个位。商业系统中WB信道的峰值传输带宽可以在发送器和接收器之间没有共享存储器的超线程设置中每个高速缓存集在1300和4400 kbps之间变化。与大多数现有的高速缓存通道（其总是针对特定的存储器地址）相比，新的WB通道关注于高速缓存组和高速缓存线状态，使得通道难以被核心上的其他进程干扰，并且它们仍然可以使用随机替换策略在高速缓存中工作。我们还从缓存加载数量和缓存未命中率的角度分析了WB通道的隐蔽性。我们讨论和评估可能的防御措施。最后讨论了各种形式的侧信道攻击。
英文摘要：
Caches have been used to construct various types of covert and side channels to leak information. Most existing cache channels exploit the timing difference between cache hits and cache misses. However, we introduce a new and broader classification of cache covert channel attacks: Hit+Miss, Hit+Hit, and Miss+Miss. We highlight that cache misses for cache lines in different states may have more significant time differences, and these can be used as timing channels. Based on this classification, we propose a new stable and stealthy Miss+Miss cache channel. Write-back caches are widely deployed in modern processors. This paper presents in detail a way in which replacement latency differences can be used to construct timing-based channels (called WB channels) to leak information in a write-back cache. Any modification to a cache line by a sender will set it to the dirty state, and the receiver can observe this through measuring the latency of replacing this cache set. We also demonstrate how senders could exploit a different number of dirty cache lines in a cache set to improve transmission bandwidth with symbols encoding multiple bits. The peak transmission bandwidths of the WB channels in commercial systems can vary between 1300 and 4400~kbps per cache set in a hyper-threaded setting without shared memory between the sender and the receiver. In contrast to most existing cache channels, which always target specific memory addresses, the new WB channels focus on the cache set and cache line states, making it difficult for the channel to be disturbed by other processes on the core, and they can still work in a cache using a random replacement policy. We also analyzed the stealthiness of WB channels from the perspective of the number of cache loads and cache miss rates. We discuss and evaluate possible defenses. The paper finishes by discussing various forms of side-channel attack.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
