基于原子混淆的通用侧信道漏洞修补方法

doi:10.11959/j.issn.2096-109x.2022014

Abstract

Abstract:

Executing code containing side-channel vulnerabilities exhibits different non-functional behaviors related to inputs.Attackers can obtain these behaviors by leveraging micro architecture side-channel attacks and then analyze the pattern between the behaviors and the inputs to access sensitive data.Vulnerability repairing at the software layer brings low overheads to a program’s execution.Besides, it does not require modifying hardware or system, which enables fast patching and widespread deployment.It becomes the mainstream strategy applied to the current cryptographic implementations.However, existing solutions are deeply bound to the program’s implementation and requires manual intervention.This brings challenge to implement and is not versatile enough.A general patching method was proposed for side-channel vulnerabilities that combined dynamic obfuscated execution with hardware atomic transaction.To hide the real accesses of the side-channel vulnerabilities of a program, the proposed method inserted dynamic confusing accesses into the vulnerabilities.To avoid an attacker using fine-grained side-channel attack to distinguish the real access and the confusing access, both of them were encapsulated as transactions and they were guaranteed to be uninterrupted during the running period.In addition, a prototype system called SC-Patcher was implemented based on the LLVM compiler.Various optimization strategies were supported, including secure springboard and transaction aggregation, to further improve system security and performance.Experimental results show that the proposed method makes it impossible for an attacker to restore accurate sensitive data through side-channel attack, and it also brings almost no additional performance overhead to the program.

Key words: side-channel defense, vulnerability repair, atomic transaction, obfuscated execution

CLC Number:

TP393

Deqing ZOU, Pan ZHANG, Wei LIU, Weijie CHEN, Yifan LU. Universal patching method for side-channel vulnerabilities based on atomic obfuscation[J]. Chinese Journal of Network and Information Security, 2022, 8(2): 100-111.

Figures/Tables 6

References 39

[1]	ANDRYSCO M , KOHLBRENNER D , MOWERY K ,et al. On subnormal floating point and abnormal timing[C]// Proceedings of IEEE Symposium on Security and Privacy(S＆P’15). 2015: 623-639.
[2]	LEE S , SHIH MW , GERA P ,et al. Inferring fine-grained control flow inside SGX enclaves with branch shadowing[C]// Proceedings of 26th USENIX Security Symposium (USENIX Security’17). 2017: 557-574.
[3]	LIU F , YAROM Y , GE Q ,et al. Last-level cache side-channel attacks are practical[C]// Proceedings of IEEE Symposium on Security and Privacy(S＆P’15). 2015: 605-622.
[4]	GRUSS D , SPREITZER R , MANGARD S . Cache template attacks:Automating attacks on inclusive last-level caches[C]// Proceedings of 24th USENIX Security Symposium (USENIX Security’15). 2015: 897-912.
[5]	GRUSS D , MAURICE C , WAGNER K ,et al. Flush+ Flush:a fast and stealthy cache attack[C]// Proceedings of Detection of Intrusions and Malware,and Vulnerability Assessment (DIMVA’ 16). 2016: 279-299.
[6]	OSVIK DA , SHAMIR A , TROMER E . Cache attacks and countermeasures:the case of AES[C]// Proceedings of Cryptographers’ Track at the RSA Conference (CT-RSA’06). 2006: 1-20.
[7]	GRAS B , RAZAVI K ,, BOS H , GIUFFRIDA C ,et al. Translation leak-aside buffer:defeating cache side-channel protections with TLB attacks[C]// Proceedings of 27th USENIX Security Symposium (USENIX Security’18). 2018: 955-972.
[8]	SHINDE S , CHUA ZL , NARAYANAN V ,et al. Preventing page faults from telling your secrets[C]// Proceedings of 11th ACM on Asia Conference on Computer and Communications Security (AsiaCCS’16),Xi'an,China. 2016: 317-328.
[9]	XU Y , CUI W , PEINADO M . Controlled-channel attacks:Deterministic side channels for untrusted operating systems[C]// Proceedings of IEEE Symposium on Security and Privacy(S＆P’15). 2015: 640-656.
[10]	PESSL P , GRUSS D , MAURICE C ,et al. DRAMA:exploiting DRAM addressing for cross-cpu attacks[C]// Proceedings of 25th USENIX Security Symposium (USENIX Security’16). 2016: 565-581.
[11]	HE Z , LEE RB . How secure is your cache against side-channel attacks?[C]// Proceedings of Annual IEEE/ACM International Symposium on Microarchitecture (MICRO’17). 2017: 341-353.
[12]	ZHANG D , ASKAROV A , MYERS AC . Language-based control and mitigation of timing channels[C]// Proceedings of 33rd ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI’12). 2012: 99-110.
[13]	WANG Y , FERRAIUOLO A , ZHANG D ,et al. SecDCP:secure dynamic cache partitioning for efficient timing channel protection[C]// Proceedings of 53nd ACM/EDAC/IEEE Design Automation Conference (DAC’16). 2016: 1-6.
[14]	KIRIANSKY V , LEBEDEV I , AMARASINGHE S ,et al. DAWG:a defense against cache timing attacks in speculative execution processors[C]// Proceedings of 51st Annual IEEE/ACM International Symposium on Microarchitecture (MICRO’18). 2018: 974-987.
[15]	DENG S , XIONG W , SZEFER J . Secure tlbs[C]// Proceedings of 46th Annual International Symposium on Computer Architecture (ISCA’19). 2019: 346-359.
[16]	SHI J , SONG X , CHEN H ,et al. Limiting cache-based side-channel in multi-tenant cloud using dynamic page coloring[C]// Proceedings of 41st International Conference on Dependable Systems and Networks Workshops (DSN-W’11). 2011: 194-199.
[17]	KIM T , PEINADO M , MAINAR-RUIZ G , . STEALTHMEM:system-level protection against cache-based side channel attacks in the cloud[C]// Proceedings of 21st USENIX Security Symposium (USENIX Security’12). 2012: 189-204.
[18]	ZHANG Y , REITER MK . Du?Ppel:retrofitting commodity operating systems to mitigate cache side channels in the cloud[C]// Proceedings of 2013 ACM SIGSAC Conference on Computer ＆ Communications Security (CCS’13). 2013: 827-838.
[19]	VATTIKONDA BC , DAS S , SHACHAM H . Eliminating fine grained timers in xen[C]// Proceedings of 3rd ACM Workshop on Cloud Computing Security Workshop. 2011: 41-46.
[20]	LI P , GAO D , REITER MK . StopWatch:A Cloud Architecture for Timing Channel Mitigation[J]. ACM Transaction Information System Security, 2014(17): 1-28.
[21]	MARTIN R , DEMME J , SETHUMADHAVAN S . TimeWarp:rethinking timekeeping and performance monitoring mechanisms to mitigate side-channel attacks[C]// Proceedings of 39th Annual International Symposium on Computer Architecture (ISCA’12). 2012: 118-129.
[22]	ZHANG T , ZHANG Y , LEE R B . Cloudradar:a real-time side-channel attack detection system in clouds[C]// Proceedings of Research in Attacks,Intrusions,and Defenses (RAID’16). 2016: 118-140.
[23]	CHEN S , ZHANG X , REITER MK ,et al. Detecting privileged side-channel attacks in shielded execution with Déjá Vu[C]// Proceedings of 2017 ACM on Asia Conference on Computer and Communications Security (AsiaCCS’17). 2017: 7-18.
[24]	SHIH MW , LEE S , KIM T ,et al. T-SGX:eradicating controlled-channel attacks against enclave programs[C]// Proceedings of 24th Network and Distributed System Security Symposium (NDSS’17). USA, 2017.
[25]	DOYCHEV G , K?PF B , MAUBORGNE L ,et al. CacheAudit:a tool for the static analysis of cache side channels[J]. ACM Transactions on Information and System Security. 2015(18): 1-32.
[26]	ALMEIDA JB , BARBOSA M , BARTHE G ,et al. Verifying constant-time implementations[C]// Proceedings of 25th USENIX Security Symposium (USENIX Security’16). 2016: 53-70.
[27]	BARTHE G , BETARTE G , CAMPO J ,et al. System-level non-interference for constant-time cryptography[C]// Proceedings of 2014 ACM SIGSAC Conference on Computer and Communications Security (CCS’14). 2014: 1267-1279.
[28]	REPARAZ O , BALASCH J , VERBAUWHEDE I . Dude,is my code constant time[C]// Proceedings of the Conference on Design,Automation ＆ Test in Europe (DATE’17). 2017: 1701-1706.
[29]	WANG S , WANG P , LIU X ,et al. Cached:Identifying cache-based timing channels in production software[C]// Proceedings of 26th USENIX Security Symposium (USENIX Security’17). 2017: 235-252.
[30]	WICHELMANN J , MOGHIMI A , EISENBARTH T ,et al. Microwalk:a framework for finding side channels in binaries[C]// Proceedings of 34th Annual Computer Security Applications Conference (ACSAC’18). 2018: 161-173.
[31]	WU M , GUO S , SCHAUMONT P ,et al. Eliminating timing side-channel leaks using program repair[C]// Proceedings of 27th ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA’18). 2018: 15-26.
[32]	CORON J S , . Resistance against differential power analysis for elliptic curve cryptosystems[C]// Proceedings of 1th International Workshop on Cryptographic Hardware and Embedded Systems (CHES’99). 1999: 292-302.
[33]	VAN B J , PIESSENS F , STRACKX R . SGX-Step:A practical attack framework for precise enclave execution control[C]// Proceedings of 2nd Workshop on System Software for Trusted Execution (SysTEX'17). 2017: 1-6.
[34]	WEISER S , ZANKL A , SPREITZER R ,et al. DATA-differential address trace analysis:finding address-based side-channels in binaries[C]// Proceedings of 27th USENIX Security Symposium (USENIX Security’18). 2018: 603-620.
[35]	GENKIN D , PIPMAN I , TROMER E . Get your hands off my laptop:Physical side-channelkey-extraction attacks on PCs[C]// Proceedings of International Workshop on Cryptographic Hardware and Embedded Systems (CHES’14),Busan,South Korea. 2014: 242-260.
[36]	LIPP M , SCHWARZ M , GRUSS D ,et al. Meltdown:reading kernel memory from user space[C]// Proceedings of 27th USENIX Security Symposium (USENIX Security’18). 2018: 973-990.
[37]	KOCHER P , HORN J , FOGH A ,et al. Spectre attacks:exploiting speculative execution[C]// Proceedings of 2019 IEEE Symposium on Security and Privacy (S＆P’19). 2019: 1-19.
[38]	VAN BULCK J , MINKIN M , WEISSE O ,et al. Foreshadow:extracting the keys to the intel SGX kingdom with transient out-of-order execution[C]// Proceedings of 27th USENIX Security Symposium (USENIX Security’18). 2018: 991-1008.
[39]	Mastik:a micro-architectural side-channel toolkit[EB].

Metrics

Recommended 0

No Suggested Reading articles found!

类型	分类标识的原因
D	包含数据访问依赖的漏洞代码
B	包含控制选择依赖的漏洞代码
U	会导致其他类型的代码的访问信息泄露
S	安全代码，不会产生机密数据泄露

	测试内容		准确率
	原生AES		100.00%
	T-SGX		100.00%
SC-Patcher		静态混淆	78.60%
SC-Patcher		动态混淆	7.10%

测试内容	算法			二进制文件大小
测试内容	DES	AES	SHA-1	二进制文件大小
未漏洞修补	8.591 ms	6.360 ms	11.618 ms	3.138MB
漏洞修补后	8.719 ms	6.508 ms	12.261 ms	3.150MB
开销	1.42%	2.32%	5.53%	0.38%

Universal patching method for side-channel vulnerabilities based on atomic obfuscation

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 6

References 39

Related Articles 15

Metrics

Recommended 0

[1]	Xianyi CHEN, Jun GU, Kai YAN, Dong JIANG, Linfeng XU, Zhangjie FU. Double adversarial attack against license plate recognition system [J]. Chinese Journal of Network and Information Security, 2023, 9(3): 16-27.
[2]	Tianpeng YE, Xiang LIN, Jianhua LI, Xuankai ZHANG, Liwen XU. Personalized lightweight distributed network intrusion detection system in fog computing [J]. Chinese Journal of Network and Information Security, 2023, 9(3): 28-37.
[3]	Lijun ZU, Yalin CAO, Xiaohua MEN, Zhihui LYU, Jiawei YE, Hongyi LI, Liang ZHANG. Adaptive selection method of desensitization algorithm based on privacy risk assessment [J]. Chinese Journal of Network and Information Security, 2023, 9(3): 49-59.
[4]	Ruiqi XIA, Manman LI, Shaozhen CHEN. Identification on the structures of block ciphers using machine learning [J]. Chinese Journal of Network and Information Security, 2023, 9(3): 79-89.
[5]	Jingyi YUAN, Zichuan LI, Guojun PENG. EN-Bypass: a security assessment method on e-mail user interface notification [J]. Chinese Journal of Network and Information Security, 2023, 9(3): 90-101.
[6]	Feng YU, Qingxin LIN, Hui LIN, Xiaoding WANG. Privacy-enhanced federated learning scheme based on generative adversarial networks [J]. Chinese Journal of Network and Information Security, 2023, 9(3): 113-122.
[7]	Chuntao ZHU, Chengxi YIN, Bolin ZHANG, Qilin YIN, Wei LU. Forgery face detection method based on multi-domain temporal features mining [J]. Chinese Journal of Network and Information Security, 2023, 9(3): 123-134.
[8]	Xiaomeng LI, Daidou GUO, Xunfang ZHUO, Heng YAO, Chuan QIN. Carrier-independent screen-shooting resistant watermarking based on information overlay superimposition [J]. Chinese Journal of Network and Information Security, 2023, 9(3): 135-149.
[9]	Zhao CAI, Tao JING, Shuang REN. Survey on Ethereum phishing detection technology [J]. Chinese Journal of Network and Information Security, 2023, 9(2): 21-32.
[10]	Yan PAN, Wei LIN, Yuefei ZHU. Progressive active inference method of protocol state machine [J]. Chinese Journal of Network and Information Security, 2023, 9(2): 81-93.
[11]	Pan YANG, Fei KANG, Hui SHU, Yuyao HUANG, Xiaoshao LYU. Binary program taint analysis optimization method based on function summary [J]. Chinese Journal of Network and Information Security, 2023, 9(2): 115-131.
[12]	Tian XIAO, Zhihao JIANG, Peng TANG, Zheng HUANG, Jie GUO, Weidong QIU. High-performance directional fuzzing scheme based on deep reinforcement learning [J]. Chinese Journal of Network and Information Security, 2023, 9(2): 132-142.
[13]	Chenghao YUAN, Yong LI, Shuang REN. Dynamic multi-keyword searchable encryption scheme [J]. Chinese Journal of Network and Information Security, 2023, 9(2): 143-153.
[14]	Zezhou HOU, Jiongjiong REN, Shaozhen CHEN. Security evaluation for parameters of SIMON-like cipher based on neural network distinguisher [J]. Chinese Journal of Network and Information Security, 2023, 9(2): 154-163.
[15]	Xuejing GUO, Yixiang FANG, Yi ZHAO, Tianzhu ZHANG, Wenchao ZENG, Junxiang WANG. Traditional guidance mechanism based deep robust watermarking [J]. Chinese Journal of Network and Information Security, 2023, 9(2): 175-183.