CacheFX：一个Cache安全性评估框架
CacheFX: A Framework for Evaluating Cache Security
摘要：
在过去的二十年里，在程序之间共享资源的危险一再被强调。已经设计了多个侧信道攻击，其寻求利用共享组件来泄漏信息，主要针对共享缓存组件。作为回应，研究界提出了多个缓存设计，旨在遏制侧通道的来源。对于多种竞争设计，需要评估每种设计提供的针对侧信道攻击的安全级别。在这项工作中，我们提出CacheFX，一个灵活的框架，用于评估和评估缓存设计的弹性侧信道攻击。CacheFX允许评估者实现各种缓存设计、受害者和攻击者，并练习它们来评估通过缓存的信息泄漏。为了展示CacheFX的强大功能，我们实现了多个缓存设计和替换算法，并设计了三个评估指标来衡量缓存的不同方面：（1）内存访问引起的熵;（2）构建驱逐集的复杂性;（3）针对加密攻击的保护。我们的实验强调，不同的安全指标提供了不同的见解设计，使全面的分析是强制性的。例如，虽然随机偏斜缓存的驱逐集构建速度最快，但这些缓存具有较低的驱逐熵和较高的实际攻击复杂性。我们的实验表明，所有的非分区设计允许有效的密码攻击。然而，在最先进的安全缓存中，基于驱逐的攻击比基于占用的攻击更难安装，突出了在缓存设计中考虑后者的必要性。
英文摘要：
Over the last two decades, the danger of sharing resources between programs has been repeatedly highlighted. Multiple side-channel attacks, which seek to exploit shared components for leaking information, have been devised, mostly targeting shared caching components. In response, the research community has proposed multiple cache designs that aim at curbing the source of side channels. With multiple competing designs, there is a need for assessing the level of security against side-channel attacks that each design offers. In this work we propose CacheFX, a flexible framework for assessing and evaluating the resilience of cache designs to side-channel attacks. CacheFX allows the evaluator to implement various cache designs, victims, and attackers, as well as to exercise them for assessing the leakage of information via the cache. To demonstrate the power of CacheFX, we implement multiple cache designs and replacement algorithms, and devise three evaluation metrics that measure different aspects of the caches:(1) the entropy induced by a memory access; (2) the complexity of building an eviction set; and (3) protection against cryptographic attacks. Our experiments highlight that different security metrics give different insights to designs, making a comprehensive analysis mandatory. For instance, while eviction-set building was fastest for randomized skewed caches, these caches featured lower eviction entropy and higher practical attack complexity. Our experiments show that all non-partitioned designs allow for effective cryptographic attacks. However, in state-of-the-art secure caches, eviction-based attacks are more difficult to mount than occupancy-based attacks, highlighting the need to consider the latter in cache design.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
