SoK: Can We Really Detect Cache Side-Channel Attacks by Monitoring Performance Counters?

Simple item page
dc.contributor.authorKosasih, W.
dc.contributor.authorFeng, Y.
dc.contributor.authorChuengsatiansup, C.
dc.contributor.authorYarom, Y.
dc.contributor.authorZhu, Z.
dc.contributor.conferenceAsia Conference on Computer and Communications Security (1 Jul 2024 - 5 Jul 2024 : Singapore, Singapore)
dc.contributor.editorZhou, J.
dc.contributor.editorQuek, T.Q.S.
dc.contributor.editorGao, D.
dc.contributor.editorCardenas, A.
dc.date.issued2024
dc.description.abstractSharing microarchitectural components between co-resident programs leads to potential information leaks, with devastating implications on security. Over the last decade, multiple proposals suggested monitoring hardware performance counters as a method for detecting such attacks. In this work we investigate these proposals and find that the promising results presented in most are unlikely to carry over to realistic use scenarios. We identify four main shortcomings affecting many of the proposals: implications of detection accuracy, unaccounted performance overheads, undocumented or slow detection speed and a weak threat model. We further find that research artifacts for the vast majority of proposals are not available, significantly hampering the reproducibility and scientific validation of the results. To overcome the reproducibility issue, we implement a detection scheme similar to those proposed in literature, achieving results similar to those in the literature. We then focus on the last shortcoming—the weak threat model. We observe that the threat model in existing proposals assumes that the attacker uses some variants of published proof-of-concept attacks, without trying to hide the attack. Instead, we propose an attack that modifies a benign program. We demonstrate that such attacks remain feasible, yet display no statistically significant variations in performance counter values. Hence, such attacks cannot be detected by monitoring performance counters. We therefore conclude that despite the large number of proposals, side-channel attack detection with hardware performance counters is not yet ready for real-world deployment.
dc.description.statementofresponsibilityWilliam Kosasih, Yusi Feng, Chitchanok Chuengsatiansup, Yuval Yarom, Ziyuan Zhu
dc.identifier.citationProceedings of the 19th ACM Asia Conference on Computer and Communications Security (2024), 2024 / Zhou, J., Quek, T.Q.S., Gao, D., Cardenas, A. (ed./s), pp.172-185
dc.identifier.doi10.1145/3634737.3637649
dc.identifier.orcidKosasih, W. [0000-0003-1527-1519]
dc.identifier.orcidYarom, Y. [0000-0003-0401-4197]
dc.identifier.urihttps://hdl.handle.net/2440/143802
dc.language.isoen
dc.publisherACM
dc.publisher.placeOnline
dc.relation.granthttp://purl.org/au-research/grants/arc/DE200101577
dc.relation.granthttp://purl.org/au-research/grants/arc/DP210102670
dc.rights© 2024 Copyright held by the owner/author(s). This work is licensed under a Creative Commons Attribution International 4.0 License.
dc.source.urihttp://dx.doi.org/10.1145/3634737.3637649
dc.subjectHPC-based detection; cache side-channel attacks; security metrics
dc.titleSoK: Can We Really Detect Cache Side-Channel Attacks by Monitoring Performance Counters?
dc.typeConference paper
pubs.publication-statusPublished

Files

Original bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
hdl_143802.pdf
Size:
666.54 KB
Format:
Adobe Portable Document Format
Description:
Published version
Download

Collections

Research Outputs