US 9,436,603 B1 · Detection and mitigation of timing side-channel attacks

Abstract

During execution of an application that accesses a shared memory, a security component may, based on an indication from a performance monitor, determine that the application is carrying out a timing side-channel attack. The performance monitor may trigger an interrupt if a pre-determined number of cache line flushes is executed, after which the security component may inspect program instructions of the executing application to determine whether those instructions are likely being used in such an attack. In response to determining that an attack is under way, the security component may take action to mitigate or curtail the attack. The security component may modify the program instructions or page mapping of the executing application to make accesses to portions of the shared memory targeted by the cache line flushes predictable or consistent (e.g., by replacing the instructions with traps, removing them, or inserting instructions immediately before or after them).

Claims19

Dependent claims

A method, comprising:

configuring a performance monitor to emulate trapping on a cache line flush type instruction, wherein said configuring comprises configuring a hardware performance counter to trigger an interrupt after a pre-determined number of cache line flush type instructions have been executed;
in response to the hardware performance counter triggering an interrupt after the pre-determined number of cache line flush type instructions have been executed:
inspecting program instructions of an executing process or application that includes the cache line flush type instructions;
determining, dependent at least in part on said inspecting, whether the cache line flush type instructions are being employed within a timing side-channel attack;
and
in response to determining that the cache line flush type instructions are being employed within a timing side-channel attack, taking action to curtail the timing side-channel attack, wherein said taking action comprises modifying the program instructions or page mapping of the executing process or application that includes the cache line flush type instructions.

3 more elements

A system, comprising:

one or more processors, wherein the one or more processors comprise a performance counter configured to detect execution of cache line flush type instructions of the one or more processors;
and
a memory coupled to the one or more processors;
wherein the memory stores program instructions executable by the one or more processors to implement at least a portion of an application;
wherein the memory stores program instructions executable by the one or more processors to implement a security component;
and
wherein in response to detection by the performance counter that one or more cache line flush type instructions of the one or more processors have been executed by the at least a portion of an application, the security component is configured to:
inspect program instructions of the at least a portion of an application;
and
determine, dependent at least in part on the inspection, whether the cache line flush type instructions are part of a timing side-channel attack being carried out by the at least a portion of an application.

7 more elements

Dependencies are inferred from the claim text.

Detection and mitigation of timing side-channel attacks

Life of this patent

Detection and mitigation of timing side-channel attacks

Life of this patent

Abstract

Claims19