一句话：提出差分集合抽象，支持编译期组合精确推理，并实现同时量化与缓解缓存侧信道泄漏的工具DSA。
缓存侧信道攻击利用CPU缓存中依赖秘密的访问足迹窃取密钥等机密信息。由于缺少统一且精确的抽象，现有静态分析工具在量化与缓解方面基于不同抽象，既难以相互借鉴又导致结果不精确。本文提出差分集合（differential set）抽象，用于编译期缓存侧信道分析，其特点是支持组合式且精确的推理，并且首次同时携带量化与缓解所需的信息。基于该抽象实现静态分析工具DSA，可自动量化并缓解缓存侧信道泄漏。在常用基准上的实验表明，与仅量化或仅缓解的最先进工具相比，DSA能给出更精确的泄漏上界，并生成内存足迹更少的缓解后代码。
Cache side-channel attacks leverage secret-dependent footprints in CPU cache to steal confidential information, such as encryption keys. Due to the lack of a proper abstraction for reasoning about cache side channels, existing static program analysis tools that can quantify or mitigate cache side channels are built on very different kinds of abstractions. As a consequence, it is hard to bridge advances in quantification and mitigation research. Moreover, existing abstractions lead to imprecise results. In this paper, we present a novel abstraction, called differential set, for analyzing cache side channels at compile time. A distinguishing feature of differential sets is that it allows compositional and precise reasoning about cache side channels. Moreover, it is the first abstraction that carries sufficient information for both side channel quantification and mitigation. Based on this new abstraction, we develop a static analysis tool DSA that automatically quantifies and mitigates cache side channel leakage at the same time. Experimental evaluation on a set of commonly used benchmarks shows that DSA can produce more precise leakage bound as well as mitigated code with fewer memory footprints, when compared with state-of-the-art tools that only quantify or mitigate cache side channel leakage.
@article{paperbot1891,
title = {Quantifying and Mitigating Cache Side Channel Leakage with Differential Set},
author = {Cong Ma and Dinghao Wu and Gang Tan and Mahmut Taylan Kandemir and Danfeng Zhang},
journal = {Proceedings of the ACM on Programming Languages},
volume = {7},
number = {OOPSLA2},
year = {2023},
doi = {10.1145/3622850}
}