Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
skip to main content
10.1145/3613424.3614254acmconferencesArticle/Chapter ViewAbstractPublication PagesmicroConference Proceedingsconference-collections
research-article
Open access

AutoCC: Automatic Discovery of Covert Channels in Time-Shared Hardware

Published: 08 December 2023 Publication History

Abstract

Covert channels enable information leakage between security domains that should be isolated by observing execution differences in shared hardware. These channels can appear in any stateful shared resource, including caches, predictors, and accelerators. Previous works have identified many vulnerable components, demonstrating and defending against attacks via reverse engineering. However, this approach requires much human effort and reasoning. With the Cambrian explosion of specialized hardware, it is becoming increasingly difficult to identify all vulnerabilities manually.
To tackle this challenge, we propose AutoCC, a methodology that leverages formal property verification (FPV) to automatically discover covert channels in hardware that is shared between processes. AutoCC operates at the register-transfer level (RTL) to exhaustively examine any machine state left by a process after a context switch that creates an execution difference. Upon finding such a difference, AutoCC provides a precise execution trace showing how the information was encoded into the machine state and recovered.
Leveraging AutoCC’s flow to generate FPV testbenches that apply our methodology, we evaluated it on four open-source hardware projects, including two RISC-V cores and two accelerators. Without hand-written code or directed tests, AutoCC uncovered known covert channels (within minutes instead of many hours of test-driven emulations) and unknown ones. Although AutoCC is primarily intended to find covert channels, our evaluation has also found RTL bugs, demonstrating that AutoCC is an effective tool to test both the security and reliability of hardware designs.

References

[1]
Onur Acıiçmez, Shay Gueron, and Jean-Pierre Seifert. 2007. New branch prediction vulnerabilities in OpenSSL and necessary software countermeasures. In IMA International Conference on Cryptography and Coding. Springer, 185–203.
[2]
Monjur Alam, Haider Adnan Khan, Moumita Dey, Nishith Sinha, Robert Locke Callan, Alenka G Zajic, and Milos Prvulovic. 2018. One&Done: A Single-Decryption EM-Based Attack on OpenSSL’s Constant-Time Blinded RSA. In USENIX Security Symposium, Vol. 8. 585–602.
[3]
Armaiti Ardeshiricham, Wei Hu, Joshua Marxen, and Ryan Kastner. 2017. Register transfer level information flow tracking for provably secure hardware design. In Design, Automation & Test in Europe Conference & Exhibition (DATE), 2017. IEEE, 1691–1696.
[4]
Jonathan Balkind, Katie Lim, Fei Gao, Jinzheng Tu, David Wentzlaff, Michael Schaffner, Florian Zaruba, and Luca Benini. 2019. OpenPiton+Ariane: The First Open-Source, SMP Linux-booting RISC-V System Scaling From One to Many Cores. In Computer Architecture Research with RISC-V, CARRV, Vol. 19.
[5]
Jonathan Balkind, Katie Lim, Michael Schaffner, Fei Gao, Grigory Chirkov, Ang Li, Alexey Lavrov, Tri M Nguyen, Yaosheng Fu, Florian Zaruba, 2020. BYOC: a ’bring your own core’ framework for heterogeneous-ISA. In ASPLOS’25. 699–714.
[6]
Armin Biere, Alessandro Cimatti, Edmund Clarke, and Yunshan Zhu. 1999. Symbolic model checking without BDDs. In International conference on tools and algorithms for the construction and analysis of systems. Springer, 193–207.
[7]
Cadence Design Systems Inc.2015. JasperGold Apps User Guide.
[8]
Cadence Design Systems Inc.2016. JasperGold Engine Selection Guide.
[9]
Sadullah Canakci, Leila Delshadtehrani, Furkan Eris, Michael Bedford Taylor, Manuel Egele, and Ajay Joshi. 2021. DirectFuzz: Automated Test Generation for RTL Designs Using Directed Graybox Fuzzing. In 2021 58th ACM/IEEE Design Automation Conference (DAC) (San Francisco, CA, USA). IEEE Press, 529–534. https://doi.org/10.1109/DAC18074.2021.9586289
[10]
Luca P. Carloni. 2016. The Case for Embedded Scalable Platforms. In Proceedings of the 53rd Design Automation Conference (DAC). 17:1–17:6.
[11]
Sunjay Cauligi, Gary Soeller, Brian Johannesmeyer, Fraser Brown, Riad S Wahby, John Renner, Benjamin Grégoire, Gilles Barthe, Ranjit Jhala, and Deian Stefan. 2019. Fact: a DSL for timing-sensitive computation. In Proceedings of the 40th ACM SIGPLAN Conference on Programming Language Design and Implementation. 174–189.
[12]
Gregory K. Chen, Phil C. Knag, Carlos Tokunaga, and Ram K. Krishnamurthy. 2023. An Eight-Core RISC-V Processor With Compute Near Last Level Cache in Intel 4 CMOS. IEEE Journal of Solid-State Circuits 58, 4 (2023), 1117–1128. https://doi.org/10.1109/JSSC.2022.3228765
[13]
Edmund M. Clarke, Orna Grumberg, and Doron A. Peled. 2000. Model Checking. MIT Press, Cambridge, MA, USA.
[14]
Mohammad Rahmani Fadiheh, Dominik Stoffel, Clark Barrett, Subhasish Mitra, and Wolfgang Kunz. 2019. Processor hardware security vulnerabilities and their detection by unique program execution checking. In 2019 Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 994–999.
[15]
Fei Gao, Ting-Jung Chang, Ang Li, Marcelo Orenes-Vera, Davide Giri, Paul J Jackson, August Ning, Georgios Tziantzioulis, Joseph Zuckerman, Jinzheng Tu, 2023. DECADES: A 67mm 2, 1.46 TOPS, 55 Giga Cache-Coherent 64-bit RISC-V Instructions per second, Heterogeneous Manycore SoC with 109 Tiles including Accelerators, Intelligent Storage, and eFPGA in 12nm FinFET. In 2023 IEEE Custom Integrated Circuits Conference (CICC). IEEE, 1–2.
[16]
Qian Ge, Yuval Yarom, Tom Chothia, and Gernot Heiser. 2019. Time protection: the missing OS abstraction. In Proceedings of the Fourteenth EuroSys Conference 2019. 1–17.
[17]
Qian Ge, Yuval Yarom, David Cock, and Gernot Heiser. 2018. A survey of microarchitectural timing attacks and countermeasures on contemporary hardware. Journal of Cryptographic Engineering 8, 1 (2018), 1–27.
[18]
Davide Giri, Kuan-Lin Chiu, Guy Eichler, Paolo Mantovani, and Luca P Carloni. 2021. Accelerator integration for open-source SoC design. IEEE Micro 41, 4 (2021), 8–14.
[19]
Klaus v Gleissenthall, Rami Gökhan Kıcı, Deian Stefan, and Ranjit Jhala. 2019. IODINE: Verifying constant-time execution of hardware. In Usenix Security, Vol. 19. 3361338–3361436.
[20]
Ben Gras, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida. 2018. Translation leak-aside buffer: Defeating cache side-channel protections with { TLB} attacks. In 27th USENIX Security Symposium (USENIX Security 18). 955–972.
[21]
Roberto Guanciale, Musard Balliu, and Mads Dam. 2020. Inspectre: Breaking and fixing microarchitectural vulnerabilities by formal analysis. In Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security. 1853–1869.
[22]
John L. Hennessy and David A. Patterson. 2019. A New Golden Age for Computer Architecture. Commun. ACM 62, 2 (2019), 48–60.
[23]
Wei-Ming Hu. 1992. Lattice scheduling and covert channels. In Proceedings 1992 IEEE Computer Society Symposium on Research in Security and Privacy. IEEE Computer Society, 52–52.
[24]
Bo-Yuan Huang, Hongce Zhang, Pramod Subramanyan, Yakir Vizel, Aarti Gupta, and Sharad Malik. 2018. Instruction-Level Abstraction (ILA): A Uniform Specification for System-on-Chip Verification. ACM Transactions on Design Automation of Electronic Systems (TODAES) 24, 1 (2018), 1–24.
[25]
Ralf Hund, Carsten Willems, and Thorsten Holz. 2013. Practical timing side channel attacks against kernel space ASLR. In 2013 IEEE Symposium on Security and Privacy. IEEE, 191–205.
[26]
Jaewon Hur, Suhwan Song, Dongup Kwon, Eunjin Baek, Jangwoo Kim, and Byoungyoung Lee. 2021. DifuzzRTL: Differential Fuzz Testing to Find CPU Bugs. In 2021 IEEE Symposium on Security and Privacy (SP). 1286–1303. https://doi.org/10.1109/SP40001.2021.00103
[27]
IEEE. 2013. Standard for SystemVerilog–Unified Hardware Design, Specification, and Verification Language. IEEE 1800-2012, 1–1315. https://doi.org/10.1109/IEEESTD.2013.6469140
[28]
Gorka Irazoqui, Thomas Eisenbarth, and Berk Sunar. 2015. A shared cache attack that works across cores and defies VM sandboxing–and its application to AES. In 2015 IEEE Symposium on Security and Privacy. IEEE, 591–604.
[29]
Rahul Kande, Addison Crump, Garrett Persyn, Patrick Jauernig, Ahmad-Reza Sadeghi, Aakash Tyagi, and Jeyavijayan Rajendran. 2022. TheHuzz: Instruction Fuzzing of Processors Using Golden-Reference Models for Finding Software-Exploitable Vulnerabilities. In 31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 3219–3236. https://www.usenix.org/conference/usenixsecurity22/presentation/kande
[30]
Paul Kocher, Jann Horn, Anders Fogh, Daniel Genkin, Daniel Gruss, Werner Haas, Mike Hamburg, Moritz Lipp, Stefan Mangard, Thomas Prescher, 2019. Spectre attacks: Exploiting speculative execution. In 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 1–19.
[31]
Hyoukjun Kwon, William Harris, and Hadi Esmaeilzadeh. 2017. Proving flow security of sequential logic via automatically-synthesized relational invariants. In 2017 IEEE 30th Computer Security Foundations Symposium (CSF). IEEE, 420–435.
[32]
Kevin Laeufer, Jack Koenig, Donggyu Kim, Jonathan Bachrach, and Koushik Sen. 2018. RFUZZ: Coverage-Directed Fuzz Testing of RTL on FPGAs. In 2018 IEEE/ACM International Conference on Computer-Aided Design (ICCAD) (San Diego, CA, USA). IEEE Press, 1–8. https://doi.org/10.1145/3240765.3240842
[33]
Butler W. Lampson. 1973. A Note on the Confinement Problem. Commununications of the ACM (CACM) 16 (1973), 613–615. https://doi.org/10.1145/362375.362389
[34]
Ang Li, Ting-Jung Chang, Fei Gao, Tuan Ta, Georgios Tziantzioulis, Yanghui Ou, Moyang Wang, Jinzheng Tu, Kaifeng Xu, Paul Jackson, August Ning, Grigory Chirkov, Marcelo Orenes-Vera, Shady Agwa, Xiaoyu Yan, Eric Tang, Jonathan Balkind, Christopher Batten, and David Wentzlaff. 2023. CIFER: A Cache-Coherent 12nm 16mm2 SoC With Four 64-Bit RISC-V Application Cores, 18 32-Bit RISC-V Compute Cores, and a 1541 LUT6/mm2 Synthesizable eFPGA. IEEE Solid-State Circuits Letters (2023), 1–1. https://doi.org/10.1109/LSSC.2023.3303111
[35]
Xun Li, Vineeth Kashyap, Jason K Oberg, Mohit Tiwari, Vasanth Ram Rajarathinam, Ryan Kastner, Timothy Sherwood, Ben Hardekopf, and Frederic T Chong. 2014. Sapper: A language for hardware-level security policy enforcement. In Proceedings of the 19th international conference on Architectural support for programming languages and operating systems. 97–112.
[36]
Xun Li, Mohit Tiwari, Jason K Oberg, Vineeth Kashyap, Frederic T Chong, Timothy Sherwood, and Ben Hardekopf. 2011. Caisson: a hardware description language for secure information flow. ACM Sigplan Notices 46, 6 (2011), 109–120.
[37]
Fangfei Liu, Yuval Yarom, Qian Ge, Gernot Heiser, and Ruby B Lee. 2015. Last-level cache side-channel attacks are practical. In 2015 IEEE symposium on security and privacy. IEEE, 605–622.
[38]
Albert Magyar. 2015. VSCALE. https://github.com/LGTMCU/vscale.
[39]
Yatin A Manerkar, Daniel Lustig, Margaret Martonosi, and Michael Pellauer. 2017. RTLCheck: Verifying the memory consistency of RTL designs. In Proceedings of the 50th Annual IEEE/ACM International Symposium on Microarchitecture. 463–476.
[40]
Opeoluwa Matthews, Aninda Manocha, Davide Giri, Marcelo Orenes-Vera, Esin Tureci, Tyler Sorensen, Tae Jun Ham, Juan L Aragón, Luca P Carloni, and Margaret Martonosi. 2020. MosaicSim: A Lightweight, Modular Simulator for Heterogeneous Systems. In 2020 IEEE International Symposium on Performance Analysis of Systems and Software (ISPASS). IEEE, 136–148.
[41]
Kenneth L McMillan. 1993. Symbolic model checking. In Symbolic Model Checking. Springer, 25–60.
[42]
Andres Meza, Francesco Restuccia, Ryan Kastner, and Jason Oberg. 2022. Safety verification of third-party hardware modules via information flow tracking. In Proc. 1st Real-Time Intell. Edge Comput. Workshop (RAGE) Co-Located 59th Design Autom. Conf.(DAC). 1–4.
[43]
OpenHW Group. 2023. CVA6. https://github.com/openhwgroup/cva6.
[44]
Marcelo Orenes-Vera. 2021. AutoSVA. https://github.com/PrincetonUniversity/AutoSVA.
[45]
Marcelo Orenes-Vera. 2022. MAPLE. https://github.com/PrincetonUniversity/maple.
[46]
Marcelo Orenes-Vera, Aninda Manocha, Jonathan Balkind, Fei Gao, Juan L. Aragón, David Wentzlaff, and Margaret Martonosi. 2022. Tiny but Mighty: Designing and Realizing Scalable Latency Tolerance for Manycore SoCs. In Proceedings of the 49th Annual International Symposium on Computer Architecture (New York, New York) (ISCA ’22). Association for Computing Machinery, New York, NY, USA, 817–830. https://doi.org/10.1145/3470496.3527400
[47]
Marcelo Orenes-Vera, Aninda Manocha, David Wentzlaff, and Margaret Martonosi. 2021. AutoSVA: Democratizing Formal Verification of RTL Module Interactions. In 2021 58th ACM/IEEE Design Automation Conference (DAC). 535–540. https://doi.org/10.1109/DAC18074.2021.9586118
[48]
Riccardo Paccagnella, Licheng Luo, and Christopher W Fletcher. 2021. Lord of the Ring (s): Side Channel Attacks on the CPU On-Chip Ring Interconnect Are Practical.
[49]
Luca Piccolboni, Davide Giri, and Luca P Carloni. 2022. Accelerators & Security: The Socket Approach. IEEE Computer Architecture Letters 21, 2 (2022), 65–68.
[50]
Ping Yeung and K. Larsen. 2005. Practical Assertion-based Formal Verification for SoC. In 2005 Intl. Symposium on System-on-Chip. 58–61.
[51]
Xida Ren, Logan Moody, Mohammadkazem Taram, Matthew Collin Jordan, Dean M. Tullsen, and Ashish Venkat. 2021. I See Dead µops: Leaking Secrets via Intel/AMD Micro-Op Caches. 2021 ACM/IEEE 48th Annual International Symposium on Computer Architecture (ISCA) (2021), 361–374.
[52]
Francesco Restuccia, Andres Meza, and Ryan Kastner. 2021. Aker: A Design and Verification Framework for Safe and Secure SoC Access Control. In 2021 IEEE/ACM International Conference On Computer Aided Design (ICCAD). 1–9. https://doi.org/10.1109/ICCAD51958.2021.9643538
[53]
Francesco Restuccia, Andres Meza, Ryan Kastner, and Jason Oberg. 2023. A Framework for Design, Verification, and Management of SoC Access Control Systems. IEEE Trans. Comput. 72, 2 (2023), 386–400. https://doi.org/10.1109/TC.2022.3209923
[54]
Karl Rupp. 2018. 42 Years of Microprocessor Trend Data. https://www.karlrupp.net/2018/02/42-years-of-microprocessor-trend-data/.
[55]
Erik Seligman, Tom Schubert, and MV Achutha Kiran Kumar. 2015. Formal verification: an essential toolkit for modern VLSI design. Morgan Kaufmann.
[56]
Stuart Sutherland. 2015. Who Put Assertions In My RTL Code? And Why? How RTL Design Engineers Can Benefit from the Use of SVA. SNUG Silicon Valley (2015), 1–26.
[57]
Texas Instruments. 2011. OMAP4 mobile applications platform. Product Bulletin (2011).
[58]
Timothy Trippel, Kang G. Shin, Alex Chernyakhovsky, Garret Kelly, Dominic Rizzo, and Matthew Hicks. 2022. Fuzzing Hardware Like Software. In 31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 3237–3254. https://www.usenix.org/conference/usenixsecurity22/presentation/trippel
[59]
Stephan van Schaik, Alyssa Milburn, Sebastian Österlund, Pietro Frigo, Giorgi Maisuradze, Kaveh Razavi, Herbert Bos, and Cristiano Giuffrida. 2019. RIDL: Rogue In-Flight Data Load. In 2019 IEEE Symposium on Security and Privacy (SP). 88–105. https://doi.org/10.1109/SP.2019.00087
[60]
Ashish Venkat and Dean M. Tullsen. 2014. Harnessing ISA Diversity: Design of a heterogeneous-ISA Chip Multiprocessor. In ISCA. IEEE Press.
[61]
Yingchen Wang, Riccardo Paccagnella, Elizabeth Tang He, Hovav Shacham, Christopher W. Fletcher, and David Kohlbrenner. 2022. Hertzbleed: Turning Power Side-Channel Attacks Into Remote Timing Attacks on x86. In 31st USENIX Security Symposium (USENIX Security 22). USENIX Association, Boston, MA, 679–697.
[62]
Tianrui Wei, Nazerke Turtayeva, Marcelo Orenes-Vera, Omkar Lonkar, and Jonathan Balkind. 2023. Cohort: Software-Oriented Acceleration for Heterogeneous SoCs. In Proceedings of the 28th ACM International Conference on Architectural Support for Programming Languages and Operating Systems, Volume 3 (Vancouver, BC, Canada) (ASPLOS 2023). Association for Computing Machinery, New York, NY, USA, 105–117. https://doi.org/10.1145/3582016.3582059
[63]
Nils Wistoff, Moritz Schneider, Frank K Gürkaynak, Gernot Heiser, and Luca Benini. 2023. Systematic Prevention of On-Core Timing Channels by Full Temporal Partitioning. IEEE Trans. Comput. 72, 5 (2023), 1420–1430. https://doi.org/10.1109/TC.2022.3212636
[64]
Nils Wistoff, Moritz Schneider, Frank K. Gürkaynak, Luca Benini, and Gernot Heiser. 2021. Microarchitectural Timing Channels and their Prevention on an Open-Source 64-bit RISC-V Core. In 2021 Design, Automation Test in Europe Conference Exhibition (DATE). 627–632. https://doi.org/10.23919/DATE51398.2021.9474214
[65]
Claire Wolf. 2023. SymbiYosys. https://github.com/YosysHQ/SymbiYosys.
[66]
Fan Yao, Milos Doroslovacki, and Guru Venkataramani. 2018. Are coherence protocol states vulnerable to information leakage?. In 2018 IEEE International Symposium on High Performance Computer Architecture (HPCA). IEEE, 168–179.
[67]
YosysHQ GmbH. 2023. YosysHQ. https://www.yosyshq.com/about.
[68]
Florian Zaruba and Luca Benini. 2019. The Cost of Application-Class Processing: Energy and Performance Analysis of a Linux-Ready 1.7-GHz 64-Bit RISC-V Core in 22-nm FDSOI Technology. IEEE Transactions on Very Large Scale Integration (VLSI) Systems 27, 11 (2019), 2629–2640. https://doi.org/10.1109/TVLSI.2019.2926114
[69]
Florian Zaruba, Fabian Schuiki, Stefan Mach, and Luca Benini. 2019. The Floating Point Trinity: A Multi-modal Approach to Extreme Energy-Efficiency and Performance. In 2019 26th IEEE International Conference on Electronics, Circuits and Systems (ICECS). 767–770. https://doi.org/10.1109/ICECS46596.2019.8964820
[70]
Yu Zeng, Aarti Gupta, and Sharad Malik. 2022. Automatic generation of architecture-level models from RTL designs for processors and accelerators. In 2022 Design, Automation & Test in Europe Conference & Exhibition (DATE). IEEE, 460–465.
[71]
Danfeng Zhang, Yao Wang, G Edward Suh, and Andrew C Myers. 2015. A hardware design language for timing-sensitive information-flow security. Acm Sigplan Notices 50, 4 (2015), 503–516.

Cited By

View all
  • (2024)Bridge: A Leak-Free Hardware-Software Architecture for Parallel Embedded SystemsProceedings of the 2nd Workshop on Kernel Isolation, Safety and Verification10.1145/3698576.3698765(16-22)Online publication date: 4-Nov-2024
  • (2024)Investigating HTTP Covert Channels Through Fuzz TestingProceedings of the 19th International Conference on Availability, Reliability and Security10.1145/3664476.3664493(1-9)Online publication date: 30-Jul-2024
  • (2024)μCFI: Formal Verification of Microarchitectural Control-flow IntegrityProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security10.1145/3658644.3690344(213-227)Online publication date: 2-Dec-2024
  • Show More Cited By

Recommendations

Comments

Information & Contributors

Information

Published In

cover image ACM Conferences
MICRO '23: Proceedings of the 56th Annual IEEE/ACM International Symposium on Microarchitecture
October 2023
1528 pages
ISBN:9798400703294
DOI:10.1145/3613424
This work is licensed under a Creative Commons Attribution International 4.0 License.

Sponsors

Publisher

Association for Computing Machinery

New York, NY, United States

Publication History

Published: 08 December 2023

Check for updates

Badges

Author Tags

  1. FPV
  2. covert channel
  3. data leak
  4. flush.
  5. formal
  6. information flow
  7. microarchitectural
  8. temporal partitioning
  9. timing channel
  10. verification

Qualifiers

  • Research-article
  • Research
  • Refereed limited

Funding Sources

  • DARPA
  • Fractal

Conference

MICRO '23
Sponsor:

Acceptance Rates

Overall Acceptance Rate 484 of 2,242 submissions, 22%

Contributors

Other Metrics

Bibliometrics & Citations

Bibliometrics

Article Metrics

  • Downloads (Last 12 months)618
  • Downloads (Last 6 weeks)70
Reflects downloads up to 13 Jan 2025

Other Metrics

Citations

Cited By

View all
  • (2024)Bridge: A Leak-Free Hardware-Software Architecture for Parallel Embedded SystemsProceedings of the 2nd Workshop on Kernel Isolation, Safety and Verification10.1145/3698576.3698765(16-22)Online publication date: 4-Nov-2024
  • (2024)Investigating HTTP Covert Channels Through Fuzz TestingProceedings of the 19th International Conference on Availability, Reliability and Security10.1145/3664476.3664493(1-9)Online publication date: 30-Jul-2024
  • (2024)μCFI: Formal Verification of Microarchitectural Control-flow IntegrityProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security10.1145/3658644.3690344(213-227)Online publication date: 2-Dec-2024
  • (2024)Testing Side-channel Security of Cryptographic Implementations against Future MicroarchitecturesProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security10.1145/3658644.3670319(1076-1090)Online publication date: 2-Dec-2024

View Options

View options

PDF

View or Download as a PDF file.

PDF

eReader

View online with eReader.

eReader

HTML Format

View this article in HTML Format.

HTML Format

Login options

Media

Figures

Other

Tables

Share

Share

Share this Publication link

Share on social media