Caches have been used to construct various types of covert and side channels to leak information. Most of the previous cache channels exploit the timing difference between cache hits and cache misses. However, we introduce a new and broader classification of cache covert channel attacks: Hit+Miss, Hit+Hit, Miss+Miss. We highlight that cache misses (or cache hits) in different states may have more significant time differences, which can be used as timing channels. Based on the classification, We propose a new type of stable and stealthy Miss+Miss cache channel. The write-back caches are widely deployed in modern processors. This paper presents in detail how to use replacement latency difference to construct timing-based channels (calles WB channel) to leak information in the write-back cache: any modification to a cache line by a sender will set the cache line to the dirty state, and the receiver can observe this through measuring the latency to replace this cache set. We also demonstrate how senders could exploit a different number of dirty cache lines in a cache set to improve transmission bandwidth with symbols encoding multiple bits. The peak transmission bandwidths of the WB channels in commercial systems can vary between 1300 to 4400 Kbps per cache set in the hyper-threaded setting without shared memory between the sender and the receiver. Different from most existing cache channels that always target specific memory addresses, the new WB channels focus on the cache set and cache line states, making the channel hard to be disturbed by other processes on the core and can still work in the cache using a random replacement policy. We also analyzed the stealthiness of WB channels from the perspective of the number of cache loads and cache miss rates. Further, This paper discusses and evaluates possible defenses. The paper finishes by discussing various forms of side-channel attacks.
翻译:用于构建各种隐蔽和侧端渠道以泄漏信息。 大多数以前的缓存频道都利用了缓存点击和缓存缺失之间的时间差异。 然而, 我们引入了一个新的和更广泛的缓存隐藏频道袭击分类 : Hit+Miss+Hit、 Miss+Miss。 我们强调, 不同州的缓存漏( 或缓存点击) 可能会有更显著的时间差异, 可以用作时间频道 。 根据分类, 我们提议了一种新的稳定和隐蔽的 Miss+Miss缓存频道 。 写回缓存缓存的缓存在现代处理器中广泛部署。 本文详细介绍了如何使用替换缓存差异来构建基于时间的缓存频道( Chit+Miss、 Hit+Hit、 Miss+Miss+Miss 。 我们强调, 缓存的缓存线可能会通过测量缓存来取代这个缓存存储器 。 我们还可以通过缓存库中的不同数量来利用不同的脏缓存线来改进缓存的缓存线, 将多个缩缩缩缩缩缩的缓存的缓存 。