The Kingsguard OS-level mitigation against cache side-channel attacks using runtime detection - Archive ouverte HAL Accéder directement au contenu
Article Dans Une Revue Annals of Telecommunications - annales des télécommunications Année : 2022

The Kingsguard OS-level mitigation against cache side-channel attacks using runtime detection

Résumé

Most of the mitigation techniques against access-driven cache side-channel attacks (CSCAs) are not very effective. This is mainly because most mitigation techniques usually protect against any given specific vulnerability of the system and do not take a system-wide approach. Moreover, they either completely remove or greatly reduce the performance benefits. Therefore, to find a security vs performance trade-off, we argue in favor of need-based protection in this paper, which will allow the operating system to apply mitigation only after successful detection of CSCAs. Thus, detection can serve as a first line of defense against such attacks. In this work, we propose a novel OS-level runtime detection-based mitigation mechanism, called the Kingsguard, against CSCAs in general-purpose operating systems. The proposed mechanism enhances the security and privacy capabilities of Linux as a proof of concept, and it can be widely used in commodity systems without any hardware modifications. We provide experimental validation by mitigating three state-of-the-art CSCAs on two different cryptosystems running under Linux. We have also provided results by analyzing the effect of the combination of multiple attacks running concurrently under variable system noise. Our results show that the Kingsguard can detect and mitigate known CSCAs with an accuracy of more than 99% and 95%, respectively.
Fichier principal
Vignette du fichier
Annals_of_Telecommunications__Kingsguard_2021-2.pdf (1001.64 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-03545078 , version 1 (18-11-2022)

Identifiants

Citer

Maria Mushtaq, Muhammad Muneeb Yousaf, Muhammad Khurram Bhatti, Vianney Lapotre, Gogniat Guy. The Kingsguard OS-level mitigation against cache side-channel attacks using runtime detection. Annals of Telecommunications - annales des télécommunications, 2022, ⟨10.1007/s12243-021-00906-3⟩. ⟨hal-03545078⟩
213 Consultations
79 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More