首页 > 最新文献

Hardware and Architectural Support for Security and Privacy最新文献

英文 中文
Architectural Supports to Protect OS Kernels from Code-Injection Attacks 保护操作系统内核免受代码注入攻击的架构支持
Pub Date : 2016-06-18 DOI: 10.1145/2948618.2948623
Hyungon Moon, Jinyong Lee, Dongil Hwang, Seonhwa Jung, Jiwon Seo, Y. Paek
The kernel code injection is a common behavior of kernel -compromising attacks where the attackers aim to gain their goals by manipulating an OS kernel. Several security mechanisms have been proposed to mitigate such threats, but they all suffer from non-negligible performance overhead. This paper introduces a hardware reference monitor, called Kargos, which can detect the kernel code injection attacks with nearly zero performance cost. Kargos monitors the behaviors of an OS kernel from outside the CPU through the standard bus interconnect and debug interface available with most major microprocessors. By watching the execution traces and memory access events in the monitored target system, Kargos uncovers attempts to execute malicious code with the kernel privilege. According to our experiments, Kargos detected all the kernel code injection attacks that we tested, yet just increasing the computational loads on the target CPU by less than 1% on average.
内核代码注入是内核妥协攻击的一种常见行为,攻击者通过操纵操作系统内核来达到目的。已经提出了几种安全机制来减轻此类威胁,但它们都受到不可忽略的性能开销的影响。本文介绍了一种硬件参考监视器Kargos,它能以近乎零的性能代价检测内核代码注入攻击。Kargos通过大多数主要微处理器提供的标准总线互连和调试接口,从CPU外部监视操作系统内核的行为。通过观察被监视的目标系统中的执行跟踪和内存访问事件,Kargos发现了使用内核特权执行恶意代码的企图。根据我们的实验,Kargos检测了我们测试过的所有内核代码注入攻击,但只使目标CPU的计算负载平均增加了不到1%。
{"title":"Architectural Supports to Protect OS Kernels from Code-Injection Attacks","authors":"Hyungon Moon, Jinyong Lee, Dongil Hwang, Seonhwa Jung, Jiwon Seo, Y. Paek","doi":"10.1145/2948618.2948623","DOIUrl":"https://doi.org/10.1145/2948618.2948623","url":null,"abstract":"The kernel code injection is a common behavior of kernel -compromising attacks where the attackers aim to gain their goals by manipulating an OS kernel. Several security mechanisms have been proposed to mitigate such threats, but they all suffer from non-negligible performance overhead. This paper introduces a hardware reference monitor, called Kargos, which can detect the kernel code injection attacks with nearly zero performance cost. Kargos monitors the behaviors of an OS kernel from outside the CPU through the standard bus interconnect and debug interface available with most major microprocessors. By watching the execution traces and memory access events in the monitored target system, Kargos uncovers attempts to execute malicious code with the kernel privilege. According to our experiments, Kargos detected all the kernel code injection attacks that we tested, yet just increasing the computational loads on the target CPU by less than 1% on average.","PeriodicalId":141766,"journal":{"name":"Hardware and Architectural Support for Security and Privacy","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128453521","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 6
Implicit Sensor-based Authentication of Smartphone Users with Smartwatch 基于隐式传感器的智能手表用户认证
Pub Date : 2016-06-18 DOI: 10.1145/2948618.2948627
Wei-Han Lee, R. Lee
Smartphones are now frequently used by end-users as the portals to cloud-based services, and smartphones are easily stolen or co-opted by an attacker. Beyond the initial login mechanism, it is highly desirable to re-authenticate end-users who are continuing to access security-critical services and data, whether in the cloud or in the smartphone. But attackers who have gained access to a logged-in smartphone have no incentive to re-authenticate, so this must be done in an automatic, non-bypassable way. Hence, this paper proposes a novel authentication system, iAuth, for implicit, continuous authentication of the end-user based on his or her behavioral characteristics, by leveraging the sensors already ubiquitously built into smartphones. We design a system that gives accurate authentication using machine learning and sensor data from multiple mobile devices. Our system can achieve 92.1% authentication accuracy with negligible system overhead and less than 2% battery consumption.
智能手机现在经常被终端用户用作云服务的入口,而智能手机很容易被攻击者窃取或利用。除了初始登录机制之外,非常需要重新验证继续访问安全关键服务和数据的最终用户,无论是在云中还是在智能手机中。但是,已经获得登录智能手机访问权限的攻击者没有动力重新进行身份验证,因此这必须以一种自动的、不可绕过的方式完成。因此,本文提出了一种新的身份验证系统iAuth,通过利用智能手机中无处不在的传感器,基于终端用户的行为特征对其进行隐式、连续的身份验证。我们设计了一个系统,使用机器学习和来自多个移动设备的传感器数据提供准确的身份验证。我们的系统可以达到92.1%的认证精度,系统开销可以忽略不计,电池消耗不到2%。
{"title":"Implicit Sensor-based Authentication of Smartphone Users with Smartwatch","authors":"Wei-Han Lee, R. Lee","doi":"10.1145/2948618.2948627","DOIUrl":"https://doi.org/10.1145/2948618.2948627","url":null,"abstract":"Smartphones are now frequently used by end-users as the portals to cloud-based services, and smartphones are easily stolen or co-opted by an attacker. Beyond the initial login mechanism, it is highly desirable to re-authenticate end-users who are continuing to access security-critical services and data, whether in the cloud or in the smartphone. But attackers who have gained access to a logged-in smartphone have no incentive to re-authenticate, so this must be done in an automatic, non-bypassable way. Hence, this paper proposes a novel authentication system, iAuth, for implicit, continuous authentication of the end-user based on his or her behavioral characteristics, by leveraging the sensors already ubiquitously built into smartphones. We design a system that gives accurate authentication using machine learning and sensor data from multiple mobile devices. Our system can achieve 92.1% authentication accuracy with negligible system overhead and less than 2% battery consumption.","PeriodicalId":141766,"journal":{"name":"Hardware and Architectural Support for Security and Privacy","volume":"82 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134161166","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 68
Can Data-Only Exploits be Detected at Runtime Using Hardware Events?: A Case Study of the Heartbleed Vulnerability 可以在运行时使用硬件事件检测仅数据的漏洞?:心脏出血漏洞的案例研究
Pub Date : 2016-06-18 DOI: 10.1145/2948618.2948620
G. Torres, Chen Liu
In this study, we investigate the feasibility of using an anomaly-based detection scheme that utilizes information collected from hardware performance counters at runtime to detect data-oriented attacks in user space libraries. Using the Heartbleed vulnerability as a test case, we studied twelve different hardware events and used a Support Vector Machine (SVM) model to classify between regular and abnormal behaviors. Our results demonstrated a detection accuracy over 92% for the two-class SVM model and over 70% for the one-class SVM model. We also studied the limitations of using certain type of hardware events and discussed possible implications of their use in detection schemes. Overall, the experiments conducted suggest that data-oriented attacks can be more difficult to detect than control-data exploits, as certain events are susceptible to interference hence less reliable.
在本研究中,我们研究了使用基于异常的检测方案的可行性,该方案利用运行时从硬件性能计数器收集的信息来检测用户空间库中面向数据的攻击。以“心脏出血”漏洞为例,研究了12种不同的硬件事件,并使用支持向量机(SVM)模型对正常和异常行为进行分类。我们的结果表明,两类SVM模型的检测精度超过92%,一类SVM模型的检测精度超过70%。我们还研究了使用某些类型的硬件事件的局限性,并讨论了在检测方案中使用它们的可能含义。总的来说,所进行的实验表明,面向数据的攻击比控制数据的攻击更难以检测,因为某些事件容易受到干扰,因此不太可靠。
{"title":"Can Data-Only Exploits be Detected at Runtime Using Hardware Events?: A Case Study of the Heartbleed Vulnerability","authors":"G. Torres, Chen Liu","doi":"10.1145/2948618.2948620","DOIUrl":"https://doi.org/10.1145/2948618.2948620","url":null,"abstract":"In this study, we investigate the feasibility of using an anomaly-based detection scheme that utilizes information collected from hardware performance counters at runtime to detect data-oriented attacks in user space libraries. Using the Heartbleed vulnerability as a test case, we studied twelve different hardware events and used a Support Vector Machine (SVM) model to classify between regular and abnormal behaviors. Our results demonstrated a detection accuracy over 92% for the two-class SVM model and over 70% for the one-class SVM model. We also studied the limitations of using certain type of hardware events and discussed possible implications of their use in detection schemes. Overall, the experiments conducted suggest that data-oriented attacks can be more difficult to detect than control-data exploits, as certain events are susceptible to interference hence less reliable.","PeriodicalId":141766,"journal":{"name":"Hardware and Architectural Support for Security and Privacy","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125327799","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 25
A Formal Security Analysis of Even-Odd Sequential Prefetching in Profiled Cache-Timing Attacks 分析缓存定时攻击中奇偶顺序预取的形式化安全性分析
Pub Date : 2016-06-18 DOI: 10.1145/2948618.2948624
Sarani Bhattacharya, C. Rebeiro, Debdeep Mukhopadhyay
Hardware cache prefetching has a profound impact on the memory access pattern of ciphers which are exploited in profiled cache-timing attacks. In this paper, we formally demonstrate that memory access patterns influenced by sequential prefetching and its variant, known as even-odd prefetcher has varying information leakage dependent on the alignment of the underlying tables used in the cipher implementation. This demonstrates that a suitable architecture choice for the hardware prefetcher combined with appropriate memory alignment in software can lead to prefetching architectures which are leakage resilient.
硬件缓存预取对密码的内存访问模式有着深远的影响,这些模式被用于配置缓存定时攻击。在本文中,我们正式证明了受顺序预取及其变体(称为奇偶预取)影响的内存访问模式根据密码实现中使用的底层表的对齐具有不同的信息泄漏。这表明,在硬件预取器中选择合适的体系结构,并结合软件中适当的内存对齐,可以导致具有泄漏弹性的预取体系结构。
{"title":"A Formal Security Analysis of Even-Odd Sequential Prefetching in Profiled Cache-Timing Attacks","authors":"Sarani Bhattacharya, C. Rebeiro, Debdeep Mukhopadhyay","doi":"10.1145/2948618.2948624","DOIUrl":"https://doi.org/10.1145/2948618.2948624","url":null,"abstract":"Hardware cache prefetching has a profound impact on the memory access pattern of ciphers which are exploited in profiled cache-timing attacks. In this paper, we formally demonstrate that memory access patterns influenced by sequential prefetching and its variant, known as even-odd prefetcher has varying information leakage dependent on the alignment of the underlying tables used in the cipher implementation. This demonstrates that a suitable architecture choice for the hardware prefetcher combined with appropriate memory alignment in software can lead to prefetching architectures which are leakage resilient.","PeriodicalId":141766,"journal":{"name":"Hardware and Architectural Support for Security and Privacy","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128902357","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 9
Using innovative instructions to create trustworthy software solutions 使用创新的说明来创建值得信赖的软件解决方案
Pub Date : 2013-06-23 DOI: 10.1145/2487726.2488370
Matthew Hoekstra, Reshma Lal, Pradeep Pappachan, Vinay Phegade, J. Cuvillo
Software developers face a number of challenges when creating applications that attempt to keep important data confidential. Even with diligent attention paid to correct software design and implementation practices, secrets can still be exposed through a single flaw in any of the privileged code on the platform, code which may have been written by thousands of developers from hundreds of organizations throughout the world. Intel is developing innovative security technology which provides the ability for software developers to maintain control of the security of sensitive code and data by creating trusted domains within applications to protect critical information during execution and at rest. This paper will describe how this technology has been effectively used in lab exercises to protect private information in applications including enterprise rights management, video chat, trusted financial transactions, and others. Examples will include both protection of local processing and the establishment of secure communication with cloud services. It will illustrate useful software design patterns that can be followed to create many additional types of trusted software solutions.
软件开发人员在创建试图对重要数据保密的应用程序时面临许多挑战。即使对正确的软件设计和实现实践进行了勤奋的关注,秘密仍然可以通过平台上任何特权代码中的单个缺陷暴露出来,这些代码可能是由来自世界各地数百个组织的数千名开发人员编写的。英特尔正在开发创新的安全技术,使软件开发人员能够通过在应用程序中创建可信域来控制敏感代码和数据的安全性,从而在执行期间和休息时保护关键信息。本文将描述如何在实验室练习中有效地使用该技术来保护应用程序中的私人信息,包括企业权限管理、视频聊天、可信金融交易等。示例包括保护本地处理和建立与云服务的安全通信。它将演示有用的软件设计模式,可以遵循这些模式来创建许多其他类型的可信软件解决方案。
{"title":"Using innovative instructions to create trustworthy software solutions","authors":"Matthew Hoekstra, Reshma Lal, Pradeep Pappachan, Vinay Phegade, J. Cuvillo","doi":"10.1145/2487726.2488370","DOIUrl":"https://doi.org/10.1145/2487726.2488370","url":null,"abstract":"Software developers face a number of challenges when creating applications that attempt to keep important data confidential. Even with diligent attention paid to correct software design and implementation practices, secrets can still be exposed through a single flaw in any of the privileged code on the platform, code which may have been written by thousands of developers from hundreds of organizations throughout the world. Intel is developing innovative security technology which provides the ability for software developers to maintain control of the security of sensitive code and data by creating trusted domains within applications to protect critical information during execution and at rest. This paper will describe how this technology has been effectively used in lab exercises to protect private information in applications including enterprise rights management, video chat, trusted financial transactions, and others. Examples will include both protection of local processing and the establishment of secure communication with cloud services. It will illustrate useful software design patterns that can be followed to create many additional types of trusted software solutions.","PeriodicalId":141766,"journal":{"name":"Hardware and Architectural Support for Security and Privacy","volume":"49 2","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-06-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134427443","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 397
Side-channel indistinguishability 边信道不可分辨性
Pub Date : 2013-06-23 DOI: 10.1145/2487726.2487735
C. Carlet, S. Guilley
We introduce a masking strategy for hardware that prevents any side-channel attacker from recovering uniquely the secret key of a cryptographic device. In this masking scheme, termed homomorphic, the sensitive data is exclusive-ored with a random value that belongs to a given set. We show that if this masking set is concealed, then no information about the cryptographic key leaks. If the masking set is public (or disclosed), then any (high-order) attack reveals a group of equiprobable keys. Those results are applied to the case of the AES, where sensitive variables are bytes. To any mask corresponds a masked substitution box. We prove that there exists a homomorphic masking with 16 masks (hence a number of substitution boxes equal to that of the same algorithm without masking) that resists mono-variate first-, second-, and third-order side-channel attacks. Furthermore, even if the masking set is public, each byte of the correct key is found only ex æquo with 15 incorrect ones, making the side-channel analysis insufficient alone -- the remaining key space shall be explored by other means (typically exhaustive search). Thus, our homomorphic masking strategy allows both to increase the number of side-channel measurements and to demand for a final non negligible brute-forcing (of complexity 16NB = 264 for AES, that has NB = 16 substitution boxes). The hardware implementation of the Rotating Substitution boxes Masking (RSM) is a practical instantiation of our homomorphic masking countermeasure.
我们为硬件引入了一种屏蔽策略,可以防止任何侧信道攻击者唯一地恢复加密设备的密钥。在这种被称为同态的掩蔽方案中,敏感数据与属于给定集合的随机值独占。我们证明,如果这个掩蔽集是隐藏的,那么没有关于加密密钥的信息泄露。如果掩蔽集是公开的(或公开的),那么任何(高阶)攻击都会揭示一组等概率密钥。这些结果应用于AES的情况,其中敏感变量是字节。任何掩码对应一个掩码替换框。我们证明存在具有16个掩码的同态掩码(因此替换盒的数量等于没有掩码的相同算法的替换盒的数量),可以抵抗单变量一阶,二阶和三阶侧信道攻击。此外,即使掩蔽集是公开的,正确密钥的每个字节也只能找到15个不正确的密钥,这使得单靠侧信道分析是不够的——剩下的密钥空间需要通过其他方式(通常是穷举搜索)来探索。因此,我们的同态屏蔽策略既可以增加侧信道测量的数量,又可以要求最终的不可忽略的暴力破解(AES的复杂度为16NB = 264,具有NB = 16个替换盒)。旋转替换盒屏蔽(RSM)的硬件实现是我们同态屏蔽对策的一个实际实例。
{"title":"Side-channel indistinguishability","authors":"C. Carlet, S. Guilley","doi":"10.1145/2487726.2487735","DOIUrl":"https://doi.org/10.1145/2487726.2487735","url":null,"abstract":"We introduce a masking strategy for hardware that prevents any side-channel attacker from recovering uniquely the secret key of a cryptographic device. In this masking scheme, termed homomorphic, the sensitive data is exclusive-ored with a random value that belongs to a given set. We show that if this masking set is concealed, then no information about the cryptographic key leaks. If the masking set is public (or disclosed), then any (high-order) attack reveals a group of equiprobable keys. Those results are applied to the case of the AES, where sensitive variables are bytes. To any mask corresponds a masked substitution box. We prove that there exists a homomorphic masking with 16 masks (hence a number of substitution boxes equal to that of the same algorithm without masking) that resists mono-variate first-, second-, and third-order side-channel attacks. Furthermore, even if the masking set is public, each byte of the correct key is found only ex æquo with 15 incorrect ones, making the side-channel analysis insufficient alone -- the remaining key space shall be explored by other means (typically exhaustive search). Thus, our homomorphic masking strategy allows both to increase the number of side-channel measurements and to demand for a final non negligible brute-forcing (of complexity 16NB = 264 for AES, that has NB = 16 substitution boxes). The hardware implementation of the Rotating Substitution boxes Masking (RSM) is a practical instantiation of our homomorphic masking countermeasure.","PeriodicalId":141766,"journal":{"name":"Hardware and Architectural Support for Security and Privacy","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-06-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129302849","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 28
Practical template-algebraic side channel attacks with extremely low data complexity 具有极低数据复杂度的实用模板-代数侧信道攻击
Pub Date : 2013-06-23 DOI: 10.1145/2487726.2487733
Yossef Oren, Ofir Weisse, A. Wool
Template-based Tolerant Algebraic Side Channel Attacks (Template-TASCA) were suggested in [20] as a way of reducing the high data complexity of template attacks by coupling them with algebraic side-channel attacks. In contrast to the maximum-likelihood method used in a standard template attack, the template-algebraic attack method uses a constraint solver to find the optimal state correlated to the measured side-channel leakage. In this work we present the first application of the template-algebraic key recovery attack to a publicly available data set (IAIK WS2). We show how our attack can successfully recover the encryption key even when the attacker has extremely limited access to the device under test -- only 200 traces in the offline phase and as little as a single trace in the online phase.
基于模板的容忍代数侧信道攻击(template - tasca)在[20]中被提出,作为一种通过将模板攻击与代数侧信道攻击耦合来降低模板攻击的高数据复杂性的方法。与标准模板攻击中使用的最大似然方法相比,模板-代数攻击方法使用约束求解器来寻找与测量的侧信道泄漏相关的最佳状态。在这项工作中,我们提出了模板-代数密钥恢复攻击对公开可用数据集(IAIK WS2)的第一个应用。我们展示了我们的攻击如何成功地恢复加密密钥,即使攻击者对被测设备的访问非常有限——在离线阶段只有200个跟踪,在在线阶段只有一个跟踪。
{"title":"Practical template-algebraic side channel attacks with extremely low data complexity","authors":"Yossef Oren, Ofir Weisse, A. Wool","doi":"10.1145/2487726.2487733","DOIUrl":"https://doi.org/10.1145/2487726.2487733","url":null,"abstract":"Template-based Tolerant Algebraic Side Channel Attacks (Template-TASCA) were suggested in [20] as a way of reducing the high data complexity of template attacks by coupling them with algebraic side-channel attacks. In contrast to the maximum-likelihood method used in a standard template attack, the template-algebraic attack method uses a constraint solver to find the optimal state correlated to the measured side-channel leakage. In this work we present the first application of the template-algebraic key recovery attack to a publicly available data set (IAIK WS2). We show how our attack can successfully recover the encryption key even when the attacker has extremely limited access to the device under test -- only 200 traces in the offline phase and as little as a single trace in the online phase.","PeriodicalId":141766,"journal":{"name":"Hardware and Architectural Support for Security and Privacy","volume":"90U 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-06-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114718630","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 10
Red team vs. blue team hardware trojan analysis: detection of a hardware trojan on an actual ASIC 红队vs蓝队硬件木马分析:在实际ASIC上检测硬件木马
Pub Date : 2013-06-23 DOI: 10.1145/2487726.2487727
M. Muehlberghuber, Frank K. Gürkaynak, Thomas Korak, Philipp Dunst, M. Hutter
We infiltrate the ASIC development chain by inserting a small denial-of-service (DoS) hardware Trojan at the fabrication design phase into an existing VLSI circuit, thereby simulating an adversary at a semiconductor foundry. Both the genuine and the altered ASICs have been fabricated using a 180 nm CMOS process. The Trojan circuit adds an overhead of only 0.5% to the original design. In order to detect the hardware Trojan, we perform side-channel analyses and apply IC-fingerprinting techniques using templates, principal component analysis (PCA), and support vector machines (SVMs). As a result, we were able to successfully identify and classify all infected ASICs from non-infected ones. To the best of our knowledge, this is the first hardware Trojan manufactured as an ASIC and has successfully been analyzed using side channels.
我们通过在制造设计阶段将一个小的拒绝服务(DoS)硬件木马插入到现有的VLSI电路中,从而渗透到ASIC开发链中,从而模拟半导体代工厂的对手。正版和改版的asic都是使用180纳米CMOS工艺制造的。特洛伊电路在原始设计的基础上只增加了0.5%的开销。为了检测硬件木马,我们执行侧信道分析,并使用模板、主成分分析(PCA)和支持向量机(svm)应用ic指纹技术。因此,我们能够成功地识别和分类所有受感染的asic和未受感染的asic。据我们所知,这是第一个作为ASIC制造的硬件木马,并已成功地使用侧通道进行了分析。
{"title":"Red team vs. blue team hardware trojan analysis: detection of a hardware trojan on an actual ASIC","authors":"M. Muehlberghuber, Frank K. Gürkaynak, Thomas Korak, Philipp Dunst, M. Hutter","doi":"10.1145/2487726.2487727","DOIUrl":"https://doi.org/10.1145/2487726.2487727","url":null,"abstract":"We infiltrate the ASIC development chain by inserting a small denial-of-service (DoS) hardware Trojan at the fabrication design phase into an existing VLSI circuit, thereby simulating an adversary at a semiconductor foundry. Both the genuine and the altered ASICs have been fabricated using a 180 nm CMOS process. The Trojan circuit adds an overhead of only 0.5% to the original design. In order to detect the hardware Trojan, we perform side-channel analyses and apply IC-fingerprinting techniques using templates, principal component analysis (PCA), and support vector machines (SVMs). As a result, we were able to successfully identify and classify all infected ASICs from non-infected ones. To the best of our knowledge, this is the first hardware Trojan manufactured as an ASIC and has successfully been analyzed using side channels.","PeriodicalId":141766,"journal":{"name":"Hardware and Architectural Support for Security and Privacy","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-06-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121616195","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 21
Micro-architectural support for metadata coherence in multi-core dynamic information flow tracking 多核动态信息流跟踪中元数据一致性的微架构支持
Pub Date : 2013-06-23 DOI: 10.1145/2487726.2487732
Juan Carlos Martínez Santos, Yunsi Fei
Dynamic information flow tracking (DIFT) has shown to be an effective security measure for detecting both memory corruption attacks and semantic attacks at run-time on a wild range of systems from embedded systems and mobile devices to cloud computing. When applying DIFT to multi-thread applications running on multi-core architectures, the data processing and metadata processing are normally decoupled, i.e., being performed in different places at different times. Therefore, if the metadata access is not in the same order as data access, inconsistency issues may arise, which would reduce the security effectiveness of DIFT. Avoiding such inconsistency between data access and metadata access, i.e., maintaining metadata coherence, has become a challenging issue. In this paper, we propose METACE (METAdata Coherence Enforcement). METACE includes architectural enhancement in the memory management unit and leverages the existing cache coherence hardware and protocol to enforce metadata coherence. It introduces minimum changes to cores, coprocessors, and the memory hierarchy. It covers the complete set of data dependencies without deadlocks and is compatible with different memory consistency models. Our approach does not require modification of the source code. METACE supports out-of-order metadata access resulting in less performance degradation than previous approaches.
动态信息流跟踪(DIFT)已被证明是一种有效的安全措施,可以在从嵌入式系统、移动设备到云计算的各种系统的运行时检测内存损坏攻击和语义攻击。当将DIFT应用于运行在多核架构上的多线程应用程序时,数据处理和元数据处理通常是解耦的,即在不同的时间在不同的地方执行。因此,如果元数据访问的顺序与数据访问的顺序不一致,就可能出现不一致的问题,从而降低DIFT的安全有效性。避免数据访问和元数据访问之间的这种不一致,即保持元数据一致性,已成为一个具有挑战性的问题。在本文中,我们提出了METACE (METAdata Coherence Enforcement)。METACE包括内存管理单元的架构增强,并利用现有的缓存一致性硬件和协议来强制元数据一致性。它对核心、协处理器和内存层次结构引入了最小的更改。它涵盖了没有死锁的完整数据依赖集,并与不同的内存一致性模型兼容。我们的方法不需要修改源代码。METACE支持乱序元数据访问,因此比以前的方法性能下降更小。
{"title":"Micro-architectural support for metadata coherence in multi-core dynamic information flow tracking","authors":"Juan Carlos Martínez Santos, Yunsi Fei","doi":"10.1145/2487726.2487732","DOIUrl":"https://doi.org/10.1145/2487726.2487732","url":null,"abstract":"Dynamic information flow tracking (DIFT) has shown to be an effective security measure for detecting both memory corruption attacks and semantic attacks at run-time on a wild range of systems from embedded systems and mobile devices to cloud computing. When applying DIFT to multi-thread applications running on multi-core architectures, the data processing and metadata processing are normally decoupled, i.e., being performed in different places at different times. Therefore, if the metadata access is not in the same order as data access, inconsistency issues may arise, which would reduce the security effectiveness of DIFT. Avoiding such inconsistency between data access and metadata access, i.e., maintaining metadata coherence, has become a challenging issue. In this paper, we propose METACE (METAdata Coherence Enforcement). METACE includes architectural enhancement in the memory management unit and leverages the existing cache coherence hardware and protocol to enforce metadata coherence. It introduces minimum changes to cores, coprocessors, and the memory hierarchy. It covers the complete set of data dependencies without deadlocks and is compatible with different memory consistency models. Our approach does not require modification of the source code. METACE supports out-of-order metadata access resulting in less performance degradation than previous approaches.","PeriodicalId":141766,"journal":{"name":"Hardware and Architectural Support for Security and Privacy","volume":"24 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-06-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133362904","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 5
Secure memories resistant to both random errors and fault injection attacks using nonlinear error correction codes 使用非线性纠错码保护存储器免受随机错误和故障注入攻击
Pub Date : 2013-06-23 DOI: 10.1145/2487726.2487731
Shizun Ge, Zhen Wang, Pei Luo, M. Karpovsky
Memories used in cryptographic devices are vulnerable to fault injection attacks. To mitigate the danger of these attacks, error control codes are often used in memories to detect maliciously injected faults. Most of codes proposed for memories in cryptographic devices are error detecting codes with small Hamming distances that cannot be used for error correction. While being able to provide sufficient protection against fault injection attacks, these codes cannot provide a satisfactory reliability under the presence of random errors. In this paper we present reliable and secure memory architectures based on two nonlinear error correcting codes. The presented coding technique can be used for detection of fault injection attacks as well as for correction of random errors. The construction and the error correction procedures for the code will be described. The error handling methodology used to distinguish between random errors and maliciously injected faults will be discussed.
加密设备中使用的存储器容易受到故障注入攻击。为了减轻这些攻击的危险,错误控制码通常在存储器中使用,以检测恶意注入的错误。大多数用于加密设备中存储器的编码都是具有小汉明距离的错误检测码,不能用于纠错。虽然这些代码能够提供足够的保护,防止错误注入攻击,但在随机错误存在的情况下,这些代码不能提供令人满意的可靠性。本文提出了一种基于非线性纠错码的可靠、安全的存储器结构。所提出的编码技术可用于故障注入攻击的检测和随机错误的校正。本文将描述该代码的构造和纠错程序。本文将讨论用于区分随机错误和恶意注入错误的错误处理方法。
{"title":"Secure memories resistant to both random errors and fault injection attacks using nonlinear error correction codes","authors":"Shizun Ge, Zhen Wang, Pei Luo, M. Karpovsky","doi":"10.1145/2487726.2487731","DOIUrl":"https://doi.org/10.1145/2487726.2487731","url":null,"abstract":"Memories used in cryptographic devices are vulnerable to fault injection attacks. To mitigate the danger of these attacks, error control codes are often used in memories to detect maliciously injected faults. Most of codes proposed for memories in cryptographic devices are error detecting codes with small Hamming distances that cannot be used for error correction. While being able to provide sufficient protection against fault injection attacks, these codes cannot provide a satisfactory reliability under the presence of random errors. In this paper we present reliable and secure memory architectures based on two nonlinear error correcting codes. The presented coding technique can be used for detection of fault injection attacks as well as for correction of random errors. The construction and the error correction procedures for the code will be described. The error handling methodology used to distinguish between random errors and maliciously injected faults will be discussed.","PeriodicalId":141766,"journal":{"name":"Hardware and Architectural Support for Security and Privacy","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-06-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128160611","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
引用次数: 11
期刊
Hardware and Architectural Support for Security and Privacy
全部 Acc. Chem. Res. ACS Applied Bio Materials ACS Appl. Electron. Mater. ACS Appl. Energy Mater. ACS Appl. Mater. Interfaces ACS Appl. Nano Mater. ACS Appl. Polym. Mater. ACS BIOMATER-SCI ENG ACS Catal. ACS Cent. Sci. ACS Chem. Biol. ACS Chemical Health & Safety ACS Chem. Neurosci. ACS Comb. Sci. ACS Earth Space Chem. ACS Energy Lett. ACS Infect. Dis. ACS Macro Lett. ACS Mater. Lett. ACS Med. Chem. Lett. ACS Nano ACS Omega ACS Photonics ACS Sens. ACS Sustainable Chem. Eng. ACS Synth. Biol. Anal. Chem. BIOCHEMISTRY-US Bioconjugate Chem. BIOMACROMOLECULES Chem. Res. Toxicol. Chem. Rev. Chem. Mater. CRYST GROWTH DES ENERG FUEL Environ. Sci. Technol. Environ. Sci. Technol. Lett. Eur. J. Inorg. Chem. IND ENG CHEM RES Inorg. Chem. J. Agric. Food. Chem. J. Chem. Eng. Data J. Chem. Educ. J. Chem. Inf. Model. J. Chem. Theory Comput. J. Med. Chem. J. Nat. Prod. J PROTEOME RES J. Am. Chem. Soc. LANGMUIR MACROMOLECULES Mol. Pharmaceutics Nano Lett. Org. Lett. ORG PROCESS RES DEV ORGANOMETALLICS J. Org. Chem. J. Phys. Chem. J. Phys. Chem. A J. Phys. Chem. B J. Phys. Chem. C J. Phys. Chem. Lett. Analyst Anal. Methods Biomater. Sci. Catal. Sci. Technol. Chem. Commun. Chem. Soc. Rev. CHEM EDUC RES PRACT CRYSTENGCOMM Dalton Trans. Energy Environ. Sci. ENVIRON SCI-NANO ENVIRON SCI-PROC IMP ENVIRON SCI-WAT RES Faraday Discuss. Food Funct. Green Chem. Inorg. Chem. Front. Integr. Biol. J. Anal. At. Spectrom. J. Mater. Chem. A J. Mater. Chem. B J. Mater. Chem. C Lab Chip Mater. Chem. Front. Mater. Horiz. MEDCHEMCOMM Metallomics Mol. Biosyst. Mol. Syst. Des. Eng. Nanoscale Nanoscale Horiz. Nat. Prod. Rep. New J. Chem. Org. Biomol. Chem. Org. Chem. Front. PHOTOCH PHOTOBIO SCI PCCP Polym. Chem.
×
引用
GB/T 7714-2015
复制
MLA
复制
APA
复制
导出至
BibTeX EndNote RefMan NoteFirst NoteExpress
×
0
微信
客服QQ
Book学术公众号 扫码关注我们
反馈
×
意见反馈
请填写您的意见或建议
请填写您的手机或邮箱
×
提示
您的信息不完整,为了账户安全,请先补充。
现在去补充
×
提示
您因"违规操作"
具体请查看互助需知
我知道了
×
提示
现在去查看 取消
×
提示
确定
Book学术官方微信
Book学术文献互助
Book学术文献互助群
群 号:481959085
Book学术
文献互助 智能选刊 最新文献 互助须知 联系我们:info@booksci.cn
Book学术提供免费学术资源搜索服务,方便国内外学者检索中英文文献。致力于提供最便捷和优质的服务体验。
Copyright © 2023 Book学术 All rights reserved.
ghs 京公网安备 11010802042870号 京ICP备2023020795号-1