[论文解读] A Compiler Assisted Scheduler for Detecting and Mitigating Cache-Based Side Channel Attacks

Sharjeel Khan, Girish Mururu+1 more|arXiv (Cornell University)|Mar 8, 2020

Security and Verification in Computing参考文献 46被引用 5

一句话总结

Biscuit 是一种编译器辅助调度器，通过在循环入口处插入缓存未命中探测信号（beacons），检测并缓解多租户服务器环境中的缓存侧信道攻击，以预测和监控缓存行为。它在正常运行时的开销低于6%，在攻击期间的开销低于11%，对 Prime+Probe、Flush+Reload 和 Flush+Flush 攻击的检测 F-score 达到了 100%。

ABSTRACT

Side channel attacks steal secret keys by cleverly leveraging information leakages and can, therefore, break encryption. Thus, detection and mitigation of side channel attacks is a very important problem, but the solutions proposed in the literature have limitations in that they do not work in a real-world multi-tenancy setting on servers, have high false positives, or have high overheads. In this work, we demonstrate a compiler guided scheduler, Biscuit, that detects cache-based side channel attacks for processes scheduled on multi-tenancy server farms. A key element of this solution involves the use of a cache-miss model which is inserted by the compiler at the entrances of loop nests to predict the cache misses of the corresponding loop. Such inserted library calls, or beacons, convey the cache miss information to the scheduler at run time, which uses it to co-schedule processes such that their combined cache footprint does not exceed the maximum capacity of the last level cache. The scheduled processes are then monitored for actual vs predicted cache misses, and when an anomaly is detected, the scheduler performs a search to isolate the attacker. We show that Biscuit is able to detect and mitigate Prime+Probe, Flush+Reload, and Flush+Flush attacks on OpenSSL cryptography algorithms with an F-score of 1, and also to detect and mitigate degradation of service on a vision application suite with an F-score of 0.9375. Under a no-attack scenario, the scheme poses low overheads (up to a maximum of 6 percent). In the case of an attack, the scheme ends up with less than 11 percent overhead and is able to reduce the degradation of service in some cases by 40 percent. With these many desirable features such as an ability to deal with multi-tenancy, its ability to detect attacks early, its ability to mitigate those attacks, and low runtime overheads, Biscuit is a practical solution.

研究动机与目标

• 解决现实世界多租户服务器环境中缺乏实用且低开销的缓存侧信道攻击检测与缓解方案的问题。
• 克服先前方案的局限性，如高误报率、高运行时开销，以及在共享基础设施中无法扩展的问题。
• 通过编译器插入的运行时监控机制，实现在早期检测并缓解关键提取攻击（如 Flush+Reload）和拒绝服务（DoS）攻击。
• 通过在循环级别粒度上精确预测缓存足迹，实现在保持低性能开销的同时实现高检测准确率。

提出的方法

• 在循环嵌套入口处插入由编译器生成的“探测信号”——缓存未命中预测函数，基于循环边界估算运行时缓存未命中次数。
• 利用探测信号数据指导调度器，协同分配进程以最小化组合缓存足迹，确保其保持在最后一级缓存（LLC）容量范围内。
• 在执行过程中监控实际与预测的缓存未命中次数，检测可能指示侧信道攻击的异常情况。
• 在检测到异常时触发隔离程序，以识别并缓解攻击进程。
• 通过循环级别的缓存未命中建模，实现零误报，精确预测预期的缓存行为。
• 与现有操作系统的调度机制和虚拟内存隔离机制集成，无需硬件更改即可在真实世界的多租户服务器集群中运行。

实验结果

研究问题

• RQ1 编译器辅助调度器是否能在真实世界多租户服务器环境中以高准确率检测缓存侧信道攻击？
• RQ2 精确的循环级别缓存未命中预测如何减少侧信道检测中的误报？
• RQ3 在正常和攻击场景下，集成此类检测与缓解系统带来的运行时开销是多少？
• RQ4 调度器能否有效协同调度进程，防止缓存侧信道信息泄露，同时保持性能？
• RQ5 该系统在多大程度上能够缓解由缓存侧信道攻击引发的拒绝服务？

主要发现

• Biscuit 在 OpenSSL 加密工作负载上对 Prime+Probe、Flush+Reload 和 Flush+Flush 攻击的检测 F-score 达到了 1.0。
• 对于视觉应用套件，Biscuit 对拒绝服务攻击的检测 F-score 为 0.9375。
• 在正常（无攻击）场景下，Biscuit 的最大开销为 6%，适合生产环境部署。
• 在活跃攻击期间，开销最高上升至 11%，对大多数工作负载而言仍可接受。
• 在攻击场景中，Biscuit 可将部分基准测试的服务降级减少高达 40%，证明了其有效的缓解能力。
• 通过编译器插入的探测信号，可基于循环边界和运行时值准确建模预期缓存未命中，从而实现零误报。