一句话：提出自动化的运行时计时侧信道漏洞检测与缓解框架，结合软硬件信息提升检测精度并定制低开销修复。
嵌入式系统广泛用于 IoT 应用，常处理秘密数据和加密密钥，可能通过执行时间泄露。运行时计时侧信道攻击通过测量代码执行时间提取敏感信息。由于软件运行时间依赖底层硬件，高精度、低误报地检测此类漏洞很困难；又因嵌入式系统多样，低开销修复也不易。本文提出一个自动化的运行时侧信道漏洞检测与缓解框架，除分析软件代码外，还利用底层硬件架构信息来调优框架，从而实现更准确的漏洞检测和针对具体系统的定制化缓解。
Embedded systems are widely used for implementing diverse Internet-of-Things (IoT) applications. These applications often deal with secret/sensitive data and encryption keys which can potentially be leaked through timing side-channel analysis. Runtime-based timing side-channel attacks are performed by measuring the time a code takes to execute and using that information to extract sensitive data. Effectively detecting such vulnerabilities with high precision and low false positives is a challenging task due to the runtime dependence of software code on the underlying hardware. Effectively fixing such vulnerabilities with low overhead is also non-trivial due to the diverse nature of embedded systems. In this article, we propose an automatic runtime side channel vulnerability detection and mitigation framework that not only considers the software code but also use the underlying hardware architecture information to tune the framework for more accurate vulnerability detection and system-specific tailored mitigation.
DOI 原文 ·
@inproceedings{paperbot7236,
title = {Automatic Software Timing Attack Evaluation & Mitigation on Clear Hardware Assumption},
author = {Prabuddha Chakraborty},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3559516}
}