# US 12,118,381 B2 · Extraction of side channel information from multithreaded processors based on processor resource contention > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,118,381 B2 - Document ID: US12118381B2 - Status: Granted - Kind: B2 - Application number: 18/197,824 - Filed: 2023-05-16 - Published: 2023-09-14 - Granted: 2024-10-15 - Earliest claimed: 2021-02-23 - Assignees: Rapid7, Inc. - Applicants: Rapid7, Inc. - Inventors: Viliam Holub - Web page: https://patentgrep.com/patent/US12118381B2 ## CPC - G06F 9/48: Program initiating; Program switching, e.g. by interrupt - G06F 9/455: Emulation; Interpretation; Software simulation, e.g. virtualisation or emulation of application or operating system execution engines - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 9/4806: {Task transfer initiation or dispatching} - G06F 9/4843: {by program, e.g. task dispatcher, supervisor, operating system} - G06F 9/4881: {Scheduling strategies for dispatcher, e.g. round robin, multi-level priority queues} - G06F 9/50: Allocation of resources, e.g. of the central processing unit [CPU] - G06F 9/5027: {the resource being a machine, e.g. CPUs, Servers, Terminals} - G06F 9/5038: {considering the execution order of a plurality of tasks, e.g. taking priority or time dependency constraints into consideration (scheduling strategies G06F9/4881 and subgroups)} - G06F 11/3017: {where the computing system is implementing multitasking (multiprogramming arrangements G06F9/46; allocation of resources G06F9/50)} - G06F 11/302: {where the computing system component is a software system} - G06F 11/3024: {where the computing system component is a central processing unit [CPU]} - G06F 11/3093: {Configuration details thereof, e.g. installation, enabling, spatial arrangement of the probes} - G06F 11/3409: {for performance assessment} - G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/556: {involving covert channels, i.e. data leakage between processes (inhibiting the analysis of circuitry or operation with measures against power attack G06F21/755)} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2201/865: Monitoring of software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems and methods are disclosed to implement a thread sensor generation system to generate thread sensors for extracting side channel information about other executing threads on a multithreading CPU. In embodiments, the system generates a set of sensors for evaluation. Each sensor may include a sequence of arithmetic or logic operations between variables or constants, which will cause a particular resource usage pattern by the CPU. The sensors are executed on the CPU in parallel with instances of a victim thread to measure an execution slowdown profile of the sensor thread caused by CPU resource conflicts with the victim thread. Based on the execution slowdown profiles, a sensitivity metric is calculated for each sensor, which is used to select the best sensor(s) for the victim thread. Sensors generated using the disclosed techniques can be used to extract secret information via side-channel attacks on currently available multithreaded processors. ## Claims ### Claim 1 A method comprising: performing, by one or more computer devices that implements a side channel information extraction system: creating a plurality of sensors for extracting side channel information from a central processing unit (CPU) that executes multiple threads in parallel; repeatedly executing the sensors in respective sensor threads on the CPU in parallel with a victim thread; determining, based on the repeated execution of the sensors, a detection profile of the victim thread, wherein the detection profile indicates conditions of the CPU during execution of the victim thread comprising an execution slowdown of the sensor threads caused by CPU resource conflicts between the sensor threads and the victim thread; executing the sensor threads again on the CPU to determine later conditions of the CPU; and in response to a determination that the later conditions of the CPU sufficiently match the detection profile of the victim thread, generating an output indicating that the victim thread is detected on the CPU. ### Claim 2 (depends on 1) The method of claim 1, wherein the side channel information extraction system is implemented on an attacker machine that is remote from a victim machine associated with the CPU, and the method comprises the side channel information extraction system uploading the sensors to the victim machine and downloading sensor results from the victim machine. ### Claim 3 (depends on 1) The method of claim 1, wherein the side channel information extraction system is implemented on an attacker virtual machine executing on a physical host, the CPU is a physical CPU of the physical host, and the victim thread is executed by a victim virtual machine executing on the physical host. ### Claim 4 (depends on 1) The method of claim 1, further comprising: the side channel information extraction system detecting different actions performed by the victim thread and time lapses between the different actions using sensor results generated by the sensor threads. ### Claim 5 (depends on 4) The method of claim 4, wherein the different actions comprise different steps of an encryption algorithm performed by the victim thread to encrypt a secret key, and the method comprises the side channel information extraction system extracting at least a portion of the secret key using sensor results generated by the sensor threads. ### Claim 6 (depends on 1) The method of claim 1, wherein the victim thread performs a sequence of processing actions at a high resolution, and the method comprises the side channel information extraction system: executing the sensor threads using different sampling patterns; and extracting a low-resolution view of the processing actions using sensor results generated by the sensor threads. ### Claim 7 (depends on 6) The method of claim 6, wherein the victim thread processes a high-resolution image, and the method comprises the side channel information extraction system extracting a low-resolution version of the image using the sensor results. ### Claim 8 (depends on 1) The method of claim 1, wherein the method comprises the side channel information extraction system repeatedly generating new sensors to improve a sensitivity metric for detecting the victim thread. ### Claim 9 (depends on 8) The method of claim 8, wherein the new sensors are generated from one or more previous generations of sensors based on a genetic algorithm. ### Claim 10 (depends on 8) The method of claim 8, wherein the new sensors are generated using random sequences of instructions used by the victim thread. ### Claim 11 (depends on 8) The method of claim 8, wherein the new sensors are generated as code, and the code comprises a random sequence of operations and one or more system calls to measure an execution time of the random sequence of operations on the CPU. ### Claim 12 A system comprising: a side channel information extraction system implemented using one or more computer devices, configured to: create a plurality of sensors for extracting side channel information from a central processing unit (CPU) that executes multiple threads in parallel; repeatedly execute the sensors in respective sensor threads on the CPU in parallel with a victim thread; determine, based on the repeated execution of the sensors, a detection profile of the victim thread, wherein the detection profile indicates conditions of the CPU during execution of the victim thread comprising an execution slowdown of the sensor threads caused by CPU resource conflicts between the sensor threads and the victim thread; execute the sensor threads again on the CPU to determine later conditions of the CPU; and in response to a determination that the later conditions of the CPU sufficiently match the detection profile of the victim thread, generate an output indicating that the victim thread is detected on the CPU. ### Claim 13 (depends on 12) The system of claim 12, wherein the side channel information extraction system is implemented on an attacker machine that is remote from a victim machine associated with the CPU, and the side channel information extraction system is configured to upload the sensors to the victim machine and download sensor results from the victim machine. ### Claim 14 (depends on 12) The system of claim 12, wherein the side channel information extraction system is implemented on an attacker virtual machine executing on a physical host, the CPU is a physical CPU of the physical host, and the victim thread is executed by a victim virtual machine executing on the physical host. ### Claim 15 (depends on 12) The system of claim 12, wherein the side channel information extraction system is configured to use the sensor threads to detect different actions performed by the victim thread and time lapses between the different actions. ### Claim 16 (depends on 15) The system of claim 15, wherein the different actions comprise different steps of an encryption algorithm performed by the victim thread to encrypt a secret key, and the side channel information extraction system is configured to extract at least a portion of the secret key using sensor results generated by the sensor threads. ### Claim 17 (depends on 12) The system of claim 12, wherein the victim thread performs a sequence of processing actions at a high resolution, and the side channel information extraction system is configured to: execute the sensor threads at one or more low sampling resolutions using different sampling patterns; and use sensor results generated by the sensor threads to extract a low-resolution view of the processing actions. ### Claim 18 (depends on 17) The system of claim 17, wherein the victim thread processes a high-resolution image, and the side channel information extraction system is configured to extract a low-resolution version of the image using the sensor results. ### Claim 19 (depends on 12) The system of claim 12, wherein the side channel information extraction system is configured to repeatedly generate new sensors to improve a sensitivity metric for detecting the victim thread. ### Claim 20 (depends on 19) The system of claim 19, wherein the side channel information extraction system is configured to generate the new sensors from one or more previous generations of sensors based on a genetic algorithm.