Network based side channel attack (SCA) detection

A method for detecting and interrupting a cache-based side-channel attack performed with a network of chiplets, the method comprising:

• determining one or more device heartbeat vectors of the one or more chiplets, the one or more device heartbeat vectors being derived at least part from one or more measurements of activity of one of more dedicated security processors associated with the one or more chiplets;
• determining that a particular chiplet of the one or more chiplets is being attacked with a cache-based side-channel attack, the determining being based at least in part on a computed disparity exceeding a threshold, the computed disparity being computed based at least in part on one or more disparities between at least one or more device heartbeat vectors associated with the particular chiplet and one or more other device heartbeat vectors associated with others of the one or more chiplets;
• and
• employing countermeasures against the cache-based side-channel attack of the particular chiplet, the countermeasures including at least revoking one or more access rights of the particular chiplet on the network;
• wherein employing countermeasures against the cache-based side-channel attack of the particular chiplet, the countermeasures including at least revoking one or more access rights of the particular chiplet on the network comprises:
• causing the all of the one or more chiplets, except for the particular chiplet, to indicate the particular chiplet with an invalid status on one or more tables.

A network of chiplets that includes one or more chiplets, the one or more chiplets comprising:

• one or more machine-readable mediums bearing one or more executable instructions that configure the one or more chiplets to execute at least the following operations:
• (1) calibrating one or more chiplets of the network of chiplets by at least calculating a threshold, the threshold being calculated dependent upon at least a type of security algorithm being executed by the one or more of the chiplets;
• (2) determining one or more device heartbeat vectors of the one or more chiplets, the one or more device heartbeat vectors being derived at least part from one or more measurements of activity of one of more dedicated security processors associated with the one or more chiplets;
• (3) determining that a particular chiplet of the one or more chiplets is being attacked with a cache-based side-channel attack, the determining being based at least in part on a computed disparity exceeding the threshold, the computed disparity being computed based at least in part on one or more disparities between at least one or more device heartbeat vectors associated with the particular chiplet and one or more other device heartbeat vectors associated with others of the one or more chiplets;
• and
• (4) employing countermeasures against the cache-based side-channel attack of the particular chiplet, the countermeasures including at least revoking one or more access rights of the particular chiplet on the network;
• distributing one or more device heartbeat vectors associated with the particular chiplet having the one or more disparities among one or more chiplets of the network;
• wherein the distributing the one or more device heartbeat vectors among the one or more chiplets of the network comprises:
• calculating one or more Message Authentication Codes (MAC) s on the one or more device heartbeat vectors at least in part with a revocation key associated with all of the one or more chiplets;
• transmitting the one or more device heartbeat vectors and the one or more MACs throughout the network, wherein a first chiplet of the one or more chiplets transmits to all others of the one or more chiplets a first device heartbeat vector associated with the first chiplet and a first MAC computed on the first device heartbeat vector;
• and
• authenticating the transmitted one or more device heartbeat vectors and the one or more MACs, a second chiplet of the one or more chiplets authenticating at least the first device heartbeat vector and the first MAC at least in part with at least one of a status table or the revocation key.

A method for detecting and interrupting a cache-based side-channel attack performed with a network of chiplets, the method comprising:

• determining one or more device heartbeat vectors of the one or more chiplets, the one or more device heartbeat vectors being derived at least part from one or more measurements of activity of one of more dedicated security processors associated with the one or more chiplets;
• determining that a particular chiplet of the one or more chiplets is being attacked with a cache-based side-channel attack, the determining being based at least in part on a computed disparity exceeding the threshold, the computed disparity being computed based at least in part on one or more disparities between at least one or more device heartbeat vectors associated with the particular chiplet and one or more other device heartbeat vectors associated with others of the one or more chiplets;
• and
• employing countermeasures against the cache-based side-channel attack of the particular chiplet, the countermeasures including at least revoking one or more access rights of the particular chiplet on the network;
• wherein the determining that a particular chiplet of the one or more chiplets is being attacked with a cache-based side-channel attack comprises:
• distributing the one or more device heartbeat vectors among the one or more chiplets of the network;
• wherein the distributing the one or more device heartbeat vectors among the one or more chiplets of the network comprises:
• calculating one or more Message Authentication Codes (MACs) one the one or more device heartbeat vectors at least in part with a revocation key associated with all of the one or more chiplets;
• transmitting the one or more device heartbeat vectors and the one or more MACs throughout the network, wherein a first chiplet of the one or more chiplets transmits to all others of the one or more chiplets a first device heartbeat vector associated with the first chiplet and a first MAC computed on the first heartbeat vector;
• and
• authenticating the transmitted one or more device heartbeat vectors and the one or more MACs, a second chiplet of the one or more chiplets authenticating at least the first device heartbeat vector and the first MAC at least in part with at least one of a status table or the revocation key.