...
  • 主题
高级搜索  >
历史搜索 清空历史
首页> 外文期刊>Software Testing, Verification and Reliability >An exploration of effective fuzzing for side-channel cache leakage
【24h】

An exploration of effective fuzzing for side-channel cache leakage

机译：有效模糊检测侧通道高速缓存泄漏的探索

获取原文
获取原文并翻译 | 示例
           
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Adversaries can compute the secret information of a program, such as the key for encryption routines, from side channels in the light of timing-based and access-based CPU cache behaviours. As a result, it is crucial to understand whether a program is vulnerable to side-channel cache leakage or not. Yet how we can find out such a vulnerability in a program remains a problem. In this paper, we revisit this problem and contemplate a test-generation methodology, which, in both timing-based and access-based dimensions, systematically discovers the cache side-channel leakage of an arbitrary software program. At the core of our test-generation framework is an algorithm that explores the program's input space and adapts at runtime according to observed cache performance in the executed tests. We have implemented our test generator for timing-based and access-based attack tests and evaluated it with open-source subject programs, including ones from OPENSSL and Linux GDK libraries. Our extensive evaluation effectively discloses the vulnerabilities of these real-world software to both timing-based and access-based cache attacks. We also empirically show that our test generator achieves higher and comparable effectiveness, respectively, in simulations and real hardware platforms with regard to revealing cache side-channel leakage than do state-of-the-art fuzz testing tools.
机译：攻击者可以根据基于时序和基于访问的CPU缓存行为，从边信道计算程序的机密信息，例如用于加密例程的密钥。因此，了解程序是否容易受到旁通道缓存泄漏的影响至关重要。然而，如何在程序中发现这种漏洞仍然是一个问题。在本文中，我们重新审视了这个问题，并考虑了一种测试生成方法，该方法可以在基于时序和基于访问的维度上系统地发现任意软件程序的缓存侧通道泄漏。我们的测试生成框架的核心是一种算法，该算法可以探索程序的输入空间，并根据执行的测试中观察到的缓存性能在运行时进行调整。我们已经为基于定时和基于访问的攻击测试实现了测试生成器，并使用了开源主题程序（包括来自OPENSSL和Linux GDK库的主题程序）对其进行了评估。我们的广泛评估有效地揭示了这些实际软件对基于定时和基于访问的缓存攻击的漏洞。我们还根据经验表明，与最新的模糊测试工具相比，我们的测试生成器在揭示缓存侧通道泄漏方面，在仿真和真实硬件平台上分别达到了更高和相当的有效性。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号