Logo: to the web site of Uppsala University

uu.sePublications from Uppsala University
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Delay-on-Squash: Stopping Microarchitectural Replay Attacks in Their Tracks
Uppsala University, Disciplinary Domain of Science and Technology, Mathematics and Computer Science, Department of Information Technology, Computer Systems.ORCID iD: 0000-0003-4172-8607
Uppsala University, Disciplinary Domain of Science and Technology, Mathematics and Computer Science, Department of Information Technology, Computer Systems.ORCID iD: 0000-0001-8267-0232
Norwegian Univ Sci & Technol, IT Bygget, N-7034 Trondheim, Norway..ORCID iD: 0000-0003-4232-6976
2022 (English)In: ACM Transactions on Architecture and Code Optimization (TACO), ISSN 1544-3566, E-ISSN 1544-3973, Vol. 20, no 1, article id 9Article in journal (Refereed) Published
Abstract [en]

MicroScope and other similar microarchitectural replay attacks take advantage of the characteristics of speculative execution to trap the execution of the victim application in a loop, enabling the attacker to amplify a side-channel attack by executing it indefinitely. Due to the nature of the replay, it can be used to effectively attack software that are shielded against replay, even under conditions where a side-channel attack would not be possible (e.g., in secure enclaves). At the same time, unlike speculative side-channel attacks, microarchitectural replay attacks can be used to amplify the correct path of execution, rendering many existing speculative side-channel defenses ineffective. In this work, we generalize microarchitectural replay attacks beyond MicroScope and present an efficient defense against them. We make the observation that such attacks rely on repeated squashes of so-called "replay handles" and that the instructions causing the side-channel must reside in the same reorder buffer window as the handles. We propose Delay-on-Squash, a hardware-only technique for tracking squashed instructions and preventing them from being replayed by speculative replay handles. Our evaluation shows that it is possible to achieve full security against microarchitectural replay attacks with very modest hardware requirements while still maintaining 97% of the insecure baseline performance.

Place, publisher, year, edition, pages
Association for Computing Machinery (ACM), 2022. Vol. 20, no 1, article id 9
Keywords [en]
Microarchitecture, side-channels, security, replay attacks
National Category
Computer Sciences
Identifiers
URN: urn:nbn:se:uu:diva-501608DOI: 10.1145/3563695ISI: 000934935100009OAI: oai:DiVA.org:uu-501608DiVA, id: diva2:1756075
Funder
Swedish Research Council, 2015-05159Swedish Research Council, 2018-05254Available from: 2023-05-10 Created: 2023-05-10 Last updated: 2023-05-10Bibliographically approved

Open Access in DiVA

fulltext(972 kB)337 downloads
File information
File name FULLTEXT01.pdfFile size 972 kBChecksum SHA-512
13255a28b9aaad121217f699dc2151ff1951aa2ef217eb902ba2b8be566d05ae19919247c35971e40cfedb056fb69c0de189c2d0af037d138b54d8fcf90b95af
Type fulltextMimetype application/pdf

Other links

Publisher's full text

Authority records

Sakalis, ChristosKaxiras, Stefanos

Search in DiVA

By author/editor
Sakalis, ChristosKaxiras, StefanosSjalander, Magnus
By organisation
Computer Systems
In the same journal
ACM Transactions on Architecture and Code Optimization (TACO)
Computer Sciences

Search outside of DiVA

GoogleGoogle Scholar
Total: 338 downloads
The number of downloads is the sum of all downloads of full texts. It may include eg previous versions that are now no longer available

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 174 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf