Prevention of Microarchitectural Covert Channels on an Open-Source - PowerPoint PPT Presentation

Prevention of Microarchitectural Covert Channels on an Open-Source 64-bit RISC-V Core Fourth Workshop on Computer Architecture Research with RISC-V (CARRV 2020) May 29 th , 2020 Nils Wistoff Moritz Schneider Frank K. Gürkaynak Luca Benini Gernot Heiser

Outline 1. Covert channels? 2. Measure 3. Mitigate 4. Costs 5. Conclusion Integrated Systems Laboratory 2

Covert Channel security boundary File System Mail Client Supervisor (OS) Hardware Integrated Systems Laboratory 3

Covert Channel security boundary File System Mail Client Supervisor (OS) Hardware Integrated Systems Laboratory 4

Microarchitectural Timing Channel security boundary Application A Application B Trojan Spy Integrated Systems Laboratory 5

Microarchitectural Timing Channel security boundary Application A Application B Trojan Spy Indirectly modify Measure execution depending on secret time Microarchitectural State Temporally shared HW Integrated Systems Laboratory 6

Example: D$ Timing Channel D$ Application A Trojan Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 7

Example: D$ Timing Channel – Prime D$ Application A Trojan Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 8

Example: D$ Timing Channel – Prime D$ Application A Trojan Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 9

Example: D$ Timing Channel – Context switch D$ Application A Trojan Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 10

Example: D$ Timing Channel – Encode s D$ Application A Trojan Main memory s lines Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 11

Example: D$ Timing Channel – Encode s D$ Application A Trojan Main memory s lines Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 12

Example: D$ Timing Channel – Context Switch D$ Application A Trojan Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 13

Example: D$ Timing Channel – Probe D$ Application A Trojan Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 14

Example: D$ Timing Channel – Probe D$ Application A Trojan Main memory s lines Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 15

Spatial Partitioning D$ Application A Trojan OS Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 16

Spatial Partitioning D$ Application A Trojan OS Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 17

Temporal Partitioning D$ Application A Trojan Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 18

Temporal Partitioning OS : Flush D$ Application A Trojan Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 19

Temporal Partitioning D$ Application A Trojan Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 20

Temporal Partitioning OS : Flush D$ Application A Trojan Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 21

Temporal Partitioning D$ Application A Trojan Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 22

Temporal Partitioning OS : Flush D$ Application A Trojan Main memory Application B Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 23

Flush: SW Approach D$ Application A OS OS OS Trojan OS Main memory OS Application B OS OS OS Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 24

Evaluation Platform • FPGA (Genesys 2) @50MHz • Add timer peripheral and 512KiB LLC [3] Hardware platform Ariane RV64GC core [4] • Write-through 32KiB L1D$ and 16KiB L1I$ • 16-entry DTLB, 16-entry BTB, 64-entry BHT Integrated Systems Laboratory 25

Evaluation Platform Formally verified  Kernel by Data61 • • Focus on security Supervisor seL4 microkernel [5] • Port to Ariane • Enable cache colouring of LLC • FPGA (Genesys 2) @50MHz • Add timer peripheral and 512KiB LLC [3] Hardware platform Ariane RV64GC core [4] • Write-through 32KiB L1D$ and 16KiB L1I$ • 16-entry DTLB, 16-entry BTB, 64-entry BHT Integrated Systems Laboratory 26

Evaluation Platform Channel bench [1] • Measure covert channels on ARM/x86 • Application Port to RISC-V Tailor attacks to Ariane‘s  Arch • Formally verified  Kernel by Data61 • • Focus on security Supervisor seL4 microkernel [5] • Port to Ariane • Enable cache colouring of LLC • FPGA (Genesys 2) @50MHz • Add timer peripheral and 512KiB LLC [3] Hardware platform Ariane RV64GC core [4] • Write-through 32KiB L1D$ and 16KiB L1I$ • 16-entry DTLB, 16-entry BTB, 64-entry BHT Integrated Systems Laboratory 27

Channel Bench Output: L1 D$ s 0 107 t 0 83316 s 1 11 t 1 80209 s 2 112 t 2 82069 s 3 235 t 3 88152 s 4 246 t 4 88856 s 5 152 t 5 86627 Integrated Systems Laboratory 28

Channel Matrix: L1 D$ N = 10 6 Integrated Systems Laboratory 29

Channel Matrix: L1 D$ N = 10 6 Integrated Systems Laboratory 30

Channel Matrix: L1 D$ N = 10 6 M = 1667.3 mb Integrated Systems Laboratory 31

Channel Bench Output: L1 D$ s 0 107 t 0 83316 s 1 11 t 1 80209 s 2 112 t 2 82069 s 3 235 t 3 88152 s 4 246 t 4 88856 s 5 152 t 5 86627 M Integrated Systems Laboratory 32

Channel Bench Output: L1 D$ s 0 107 t 0 83316 s 0 107 t 3 88152 s 1 11 t 1 80209 s 1 11 t 5 86627 t 1 80209 s 2 112 t 2 82069 s 2 112 Shuffle s 3 235 t 3 88152 s 3 235 t 4 88856 s 4 246 t 4 88856 s 4 246 t 0 83316 s 5 152 t 5 86627 s 5 152 t 2 82069 0 M 𝑁 0 Integrated Systems Laboratory 34

Channel Bench Output: L1 D$ s 0 t 2 s 0 t 1 s 1 t 1 s 1 t 2 s 0 107 t 0 83316 s 0 107 t 3 88152 s 2 t 0 s 2 t 0 s 3 t 4 s 3 t 3 s 1 11 t 1 80209 s 1 11 t 5 86627 s 4 t 3 s 4 t 4 s 5 t 5 s 5 t 5 t 1 80209 s 2 112 t 2 82069 s 2 112 1 2 𝑁 0 𝑁 0 Shuffle Repeat s 3 235 t 3 88152 s 3 235 t 4 88856 s 0 t 5 s 0 t 5 s 1 t 2 s 1 t 4 s 4 246 t 4 88856 s 4 246 t 0 83316 s 2 t 0 s 2 t 0 s 3 t 1 s 3 t 3 s 5 152 t 5 86627 s 5 152 t 2 82069 s 4 t 3 s 4 t 1 s 5 t 4 s 5 t 2 0 𝑁 𝑁 0 3 4 𝑁 0 𝑁 0 ∗ 𝑁 0 : 95% confidence interval of 𝑁 0 𝑁 > 𝑁 0 ⇒ covert channel! Integrated Systems Laboratory 35

Channel Matrix: L1 D$ N = 10 6 M = 1667.3 mb M 0 = 0.5 mb Integrated Systems Laboratory 36

Flush: SW Approach D$ Application A OS OS OS Trojan OS Main memory OS Application B OS OS OS Spy (1) Spy: (2) OS: (3) Trojan: (4) OS: (5) Spy: Prime Cont. sw. Encode s Cont. sw. Probe Integrated Systems Laboratory 37

Software Mitigation: L1 D$ Channel Unmitigated L1 D$ prime on context switch N = 10 6 , M = 1667.3 mb, M 0 = 0.5 mb N = 10 6 , M = 1471.5 mb, M 0 = 0.6 mb Integrated Systems Laboratory 38

Software Mitigation: L1 D$ Channel Single L1 D$ prime on context switch Double L1 D$ prime on context switch N = 10 6 , M = 1471.5 mb, M 0 = 0.6 mb N = 10 6 , M = 515.7 mb, M 0 = 1.1 mb Integrated Systems Laboratory 39

Temporal Fence Instruction ( fence.t ) Integrated Systems Laboratory 40

Temporal Fence Instruction ( fence.t ) fence.t select [4] Integrated Systems Laboratory 41

Temporal Fence Instruction ( fence.t ) + Pipeline [4] Integrated Systems Laboratory 42

fence.t : L1 D$ Channel Flush targeted components Unmitigated on context switch N = 10 6 , M = 1667.3 mb, M 0 = 0.5 mb N = 10 6 , M = 7.7 mb, M 0 = 1.4 mb Integrated Systems Laboratory 43

fence.t : L1 D$ Channel Flush targeted components Unmitigated on context switch … but wait! N = 10 6 , M = 1667.3 mb, M 0 = 0.5 mb N = 10 6 , M = 7.7 mb, M 0 = 1.4 mb Integrated Systems Laboratory 44