1 of 24

CS-773 Paper Presentation��CacheFX: A Framework for Evaluating Cache Security

​

Garaga V V S Krishna Vamsi�CoR3Dump (#5)

180070020@iitb.ac.in

1

Pictures adapted from CacheFX: A Framework for Evaluating Cache Security unless otherwise mentioned

2 of 24

Coming up…

2

  1. The problem
  2. Importance of the solution
  3. Limitations of previous solutions
  4. Our solution - CacheFX
  5. More details and results
  6. Where we fall short
  7. The end :)

3 of 24

The problem

How to evaluate the security that cache designs offer against contention based cache attacks

3

4 of 24

Why you should worry about it

4

PL Cache

New Cache

Phantom Cache

CEASER

CEASER-S

Set-associative

Scatter Cache

Way-partitioned

5 of 24

Limitations of previous solutions

5

  • Focus on theoretical analysis and works only on simple cache models and also do not cover the full range of cache attacks.
  • They use synthesised adversaries which may not provide realistic insight on attacker
  • One metric may not be sufficient for confident and accurate evaluation of security

6 of 24

Background

  • Eviction set construction : common for attacks
  • Fully-associative and Set-associative caches
  • Way-partitioned and Partition-Locked caches
  • CEASER
  • CEASER-S and ScatterCache
  • PhantomCache
  • NewCache

​

6

7 of 24

Our Solution - CacheFX

7

8 of 24

Relative Eviction Entropy (REE)

Information in bits that can be leaked by the attacker due to a single memory access by the victim via cache side channel.

We use fully associative cache with random replacement policy as reference. (pu(a))

8

9 of 24

REE for different cache designs

9

10 of 24

REE of different CEASER-S configurations

10

11 of 24

Eviction Set Creation

  • Eviction set creation can be done using 3 methods,
    • Single Holdout Method (SHM)
    • Group Elimination Method(GEM)
    • Prime+Prune+Probe (PPP)

​

  • We measure the difficulty of creation by:
    • Number of memory accesses needed for the algorithm
    • Percentage of addresses that conflict with victim
    • Rate of successful eviction using this set.

​

11

12 of 24

Number of memory accesses

12

13 of 24

Number of memory accesses (CEASER-S)

13

14 of 24

Percentage of conflicting addresses

14

15 of 24

Eviction set sizes (2048 line caches)

15

16 of 24

Eviction success rate

16

17 of 24

Eviction set size for 90% eviction success

17

18 of 24

18

19 of 24

Cryptography attacks

  • Two different victims are used, both of them uses two keys to encrypt the data and the attacker tries to differentiate between the two keys.
    • AES Victim
    • Modular Exponentiation Victim

​

  • The attacker observe the average number of cache misses for each and stops when achieving a 95% confidence.

19

20 of 24

20

21 of 24

21

22 of 24

22

23 of 24

Where we fall short

  • No support on evaluation of cache hierarchies

​

  • No insight on the performance of cache design

​

  • Assumes noise free scenario (conservative)

​

  • Does not support cross core eviction based attacks

23

24 of 24

Q&A

Thank you for listening!

Any questions?

24