Publication: Detección de ataques basados en el comportamiento temporal de la cache usando contadores hardware
Loading...
Official URL
Full text at PDC
Publication Date
2019
Authors
Advisors (or tutors)
Editors
Journal Title
Journal ISSN
Volume Title
Publisher
Citations
Exportar
Abstract
En las últimas décadas han surgido múltiples ataques que buscaban explotar las brechas de seguridad de los sistemas informáticos. Entre ellos se encuentran los ataques de canal lateral a cache, destacados por no necesitar ejecutar código privilegiado en la víctima. Esto les hace una buena elección para obtener información privilegiada, dando lugar a graves problemas de seguridad, sobre todo en entornos cloud (debido a la alta compartición de recursos). A lo largo de este trabajo se ha desarrollado un programa que realiza un ataque de canal lateral al algoritmo criptográfico AES-Rijndael. El ataque aprovecha las T-tablas (que fueron introducidas para optimizar el proceso de encriptado) como objetos compartidos entre atacante y víctima, permitiendo así el uso de la técnica Flush&Reload para obtener la clave de encriptación. Se ha desarrollado un segundo programa basado en contadores hardware, que aprovecha los fallos de la memoria cache compartida para detectar cuando se produce un ataque. Además, se ha estudiado el comportamiento del detector para distintas frecuencias de muestreo, con el objetivo de aumentar su fiabilidad y reducir la carga del sistema. Finalmente, se ha estudiado la detección de ataques fragmentados en el tiempo para diferentes frecuencias de muestreo. Los resultados muestran que los contadores hardware son herramientas viables para detectar el ataque, y que utilizar el detector a frecuencias bajas es más efectivo para aumentar las posibilidades de detectar un ataque, sobre todo si el ataque está fragmentado en el tiempo.
In recent decades, there have been multiple attacks that seek to exploit the security loopholes of computer systems. Amongst them are side-channel attacks on caches, which stand out for not needing to execute privileged code from the victim. For this reason, they are often chosen to extract secret information, which can lead to serious problems, especially in cloud-based environments (due to highly shared resources). Throughout this project, a program has been developed to perform a side channel attack on the AES-Rijndael cryptographic algorithm. The attack takes advantage of T-tables (which were introduced to optimize the encryption process) as shared objects between attacker and victim, and thus enables the Flush&Reload technique to obtain the encryption key. A second program, based on performance monitoring counters (PMC) has been developed, which takes advantage of the shared cache misses to detect when there is an attack. Furthermore, the detector behavior has been studied for different sampling frequencies in order to increase reliability and to reduce system overhead. Finally, the detectability of a time fragmented attack has been studied for varying sampling frequencies. The results show that PMCs are feasible tools to detect the attack, and that sampling PMCs at lower frequencies is more effective to increase the chances of detecting an attack, especially if the attack has been fragmented in time.
In recent decades, there have been multiple attacks that seek to exploit the security loopholes of computer systems. Amongst them are side-channel attacks on caches, which stand out for not needing to execute privileged code from the victim. For this reason, they are often chosen to extract secret information, which can lead to serious problems, especially in cloud-based environments (due to highly shared resources). Throughout this project, a program has been developed to perform a side channel attack on the AES-Rijndael cryptographic algorithm. The attack takes advantage of T-tables (which were introduced to optimize the encryption process) as shared objects between attacker and victim, and thus enables the Flush&Reload technique to obtain the encryption key. A second program, based on performance monitoring counters (PMC) has been developed, which takes advantage of the shared cache misses to detect when there is an attack. Furthermore, the detector behavior has been studied for different sampling frequencies in order to increase reliability and to reduce system overhead. Finally, the detectability of a time fragmented attack has been studied for varying sampling frequencies. The results show that PMCs are feasible tools to detect the attack, and that sampling PMCs at lower frequencies is more effective to increase the chances of detecting an attack, especially if the attack has been fragmented in time.
Description
Trabajo fin de Grado, Universidad Complutense, Facultad de Informática, Departamento de Arquitectura de Computadores y Automática. Curso 2018/2019