Performing Cache Timing Attacks from the Reconfigurable Part of a Heterogeneous SoC—An Experimental Study
Source abstract
Abstract
Cache attacks are widespread on microprocessors and multi-processor system-on-chips but have not yet spread to heterogeneous systems-on-chip such as SoC-FPGA that are found in increasing numbers of applications on servers or in the cloud. This type of SoC has two parts: a processing system that includes hard components and ARM processor cores and a programmable logic part that includes logic gates to be used to implement custom designs. The two parts communicate via memory-mapped interfaces. One of these interfaces is the accelerator coherency port that provides optional cache coherency between the two parts. In this paper, we discuss the practicability and potential threat of inside-SoC cache attacks using the cache coherency mechanism of a complex heterogeneous SoC-FPGA. We provide proof of two cache timing attacks Flush+Reload and Evict+Time when SoC-FPGA is targeted, and proof of hidden communication using a cache-based covert channel. The heterogeneous SoC-FPGA Xilinx Zynq-7010 is used as an experimental target.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Security and Verification in Computing · Physical Unclonable Functions (PUFs) and Hardware Security · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Laboratoire Hubert Curien UMR 5516, CNRS, Jean Monnet University, 42000 Saint-Etienne, France
Funding
Angence Nationale de la Recherche
References (19)
Show source-provided references
1. The Security of ARM TrustZone in a FPGA-based SoC10.1109/TC.2019.2900235 ↗
2. Kamoun, N., Bossuet, L., and Gazel, A. (2008, January 20–22). SRAM-FPGA Implementation of Masked S-Box Based DPA countermeasure for AES. Proceedings of the IEEE International Design and Test Workshop (IDT), Monastir, Tunisa.10.1109/IDT.2008.4802469 ↗
3. Schellenberg, F., Gnad, D.R.E., Moradi, A., and Baradaran Tahoori, M. (2018, January 19–23). An inside job: Remote power analysis attacks on FPGAs. Proceedings of the Design, Automation & Test in Europe Conference & Exhibition (DATE), Dresden, Germany.10.23919/DATE.2018.8342177 ↗
4. Ramesh, C., Patil, S.B., Dhanuskodi, S.N., Provelengios, G., Pillement, S., Holcomb, D., and Tessier, R. (May, January 29). FPGA Side Channel Attacks without Physical Access. Proceedings of the FCCM, Boulder, CO, USA.
5. Zhao, M., and Suh, G.E. (2018, January 21–23). FPGA-Based Remote Power Side-Channel Attacks. Proceedings of the IEEE Symposium on Security and Privacy, San Francisco, CA, USA.10.1109/SP.2018.00049 ↗
6. Provelengios, G., Holcomb, D., and Tessier, R. (September, January 31). Power Wasting Circuits for Cloud FPGA Attacks. Proceedings of the 30th International Conference on Field-Programmable Logic and Applications (FPL), Gothenburg, Sweden.
7. Islam, M.N., and Kundu, S. (2018, January 22–25). PMU-Trojan: On exploiting power management side channel for information leakage. Proceedings of the ASPDAC, Jeju, Korea.10.1109/ASPDAC.2018.8297405 ↗
8. Alagappan, M., Rajendran, J., Doroslovacki, M., and Venkataramani, G. (2017, January 23–25). DFS covert channels on multi-core platforms. Proceedings of the IEEE VLSI-SoC, Abu Dhabi, United Arab Emirates.10.1109/VLSI-SoC.2017.8203469 ↗
9. Benhani, E.M., and Bossuet, L. (2018, January 9–12). DVFS as a Security Failure of TrustZone-enabled Heterogeneous SoC. Proceedings of the IEEE ICECS, Bordeaux, France.10.1109/ICECS.2018.8618038 ↗
10. Yarom, Y., and Falkner, K. (2014, January 20). FLUSH+RELOAD: A high resolution, low noise, L3 cache side-channel attack. Proceedings of the FLUSH+RELOAD: A High Resolution, Low Noise, L3 Cache Side-Channel Attack(SEC’14), USENIX Association, Berkeley, CA, USA.
11. Osvik, D.A., Shamir, A., and Tromer, E. (2006, January 13–17). Cache attacks and countermeasures: The case of AES. Proceedings of the Cryptographers’ Track at the RSA Conference, San Jose, CA, USA.10.1007/11605805_1 ↗
12. Gruss, D., Maurice, C., Wagner, K., and Mangard, S. (2016, January 7–8). Flush+Flush: A fast and stealthy cache attack. Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, San Sebastián, Spain.10.1007/978-3-319-40667-1_14 ↗
13. Lipp, M., Gruss, D., Spreitzer, R., Maurice, C., and Mangard, S. (2016, January 10–12). Armageddon: Cache attacks on mobile devices. Proceedings of the 25th USENIX Security Symposium (USENIX Security 16), Austin, TX, USA.
14. Kim, M., Kong, S., Hong, B., Xu, L., Shi, W., and Suh, T. (2017, January 27–31). Evaluating coherence-exploiting hardware trojan. Proceedings of the Design, Automation & Test in Europe Conference & Exhibition (DATE), Lausanne, Switzerland.10.23919/DATE.2017.7926975 ↗
15. Chaudhuri, S. (2018, January 24–28). A security vulnerability analysis of SoC-FPGA architectures. Proceedings of the 55th ACM/ESDA/IEEE Design Automation Conference (DAC), San Francisco, CA, USA.10.1109/DAC.2018.8465932 ↗
16. Reinbrecht, C.R.W., Susin, A., Bossuet, L., Sigl, G., and Sepulveda, M.J. (September, January 29). Side Channel Attack on NoC-based MPSoCs are pratical: NOC prime+probe attack. Proceedings of the 29th IEEE Symposium on Integrated Circuits and Systems Design, (SBCCI), Belo Horizonte, Brazil.
17. Xilinx (2021, June 25). Zynq-7010 All Programmable SoC Technical Reference Manual, UG585 v1.11. Available online: https://www.xilinx.com/.
18. Benhani, E.M., and Bossuet, L. (2017). Design a TrustZone-Enable SoC using Xilinx VIVADO CAD Tool, University of Lyon. Technical Report.
19. Gaspar, L., Fischer, V., Bernard, F., Bossuet, L., and Cotret, P. (2010, January 13–15). HCrypt: A Novel Reconfigurable Crypto-processor with Secured Key Management. Proceedings of the International Conference on ReConFigurable Computing and FPGAs, Cancun, Mexico.10.1109/ReConFig.2010.38 ↗