一句话：提出 DAGguise，用抽象的有向无环请求图 rDAG 塑造访存模式，在允许动态竞争的同时消除内存时序侧信道并形式化验证其安全性。
本文研究内存时序侧信道的防御问题：攻击者利用 DRAM 控制器内部的资源争用来推断受害者的秘密。此类信道已被证明切实可行，对共享内存环境下的安全计算构成重要挑战；而现有最先进防御要么需要繁重的静态带宽划分与大量 profiling，要么无法防御利用细粒度时序与 bank 信息的攻击。作者提出 DAGguise，其核心是一种新的抽象访存表示——有向无环请求图（rDAG），用于建模经历资源争用的访存模式。DAGguise 通过轻量 profiling 阶段得到一个公开已知的 rDAG，并将受害者的访存模式塑形为与之匹配，从而完全消除信息泄露，同时保留动态流量竞争以获得良好性能。作者对 DAGguise 的安全性进行了形式化验证，证明其保持强安全保证。实验表明，相对最先进的 Fixed Service 机制，DAGguise 带来 12% 的整体系统加速，对无需保护的共置应用最高可达 20% 的相对加速。作者进一步认为，该原理可推广至片上网络、SMT 核心中的功能单元等其他基于调度器的时序侧信道。
This paper studies the mitigation of memory timing side channels, where attackers utilize contention within DRAM controllers to infer a victim’s secrets. Already practical, this class of channels poses an important challenge to secure computing in shared memory environments. Existing state-of-the-art memory timing side channel mitigations have several key performance and security limitations. Prior schemes require onerous static bandwidth partitioning, extensive profiling phases, or simply fail to protect against attacks which exploit fine-grained timing and bank information. We present DAGguise, a defense mechanism which fully protects against memory timing side channels while allowing for dynamic traffic contention in order to achieve good performance. DAGguise utilizes a novel abstract memory access representation, the Directed Acyclic Request Graph (rDAG for short), to model memory access patterns which experience contention. DAGguise shapes a victim’s memory access patterns according to a publicly known rDAG obtained through a lightweight profiling stage, completely eliminating information leakage. We formally verify the security of DAGguise, proving that it maintains strong security guarantees. Moreover, by allowing dynamic traffic contention, DAGguise achieves a 12% overall system speedup relative to Fixed Service, which is the state-of-the-art mitigation mechanism, with up to a 20% relative speedup for co-located applications which do not require protection. We further claim that the principles of DAGguise can be generalized to protect against other types of scheduler-based timing side channels, such as those targeting on-chip networks, or functional units in SMT cores.
@inproceedings{DeutschYBDEY22,
title = {DAGguise: mitigating memory timing side channels},
author = {Peter W. Deutsch and Yuheng Yang and Thomas Bourgeat and Jules Drean and Joel S. Emer and Mengjia Yan},
booktitle = {ASPLOS},
year = {2022},
doi = {10.1145/3503222.3507747}
}