nach oben

Erschienen in:

2024 | OriginalPaper | Buchkapitel

8. Microarchitectural Vulnerabilities Introduced, Exploited, and Accelerated by Heterogeneous FPGA-CPU Platforms

verfasst von : Thore Tiemann, Zane Weissman, Thomas Eisenbarth, Berk Sunar

Erschienen in: Security of FPGA-Accelerated Cloud Computing Environments

Verlag: Springer International Publishing

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config

KI-gestützte Suche

Aus

Abstract

After years of development, FPGAs finally made an appearance on multi-tenant cloud servers in the late 2010s. Research in micro-architectural attacks has uncovered a variety of vulnerabilities on shared compute devices like CPUs and GPUs which pose a substantial thread to cloud service providers and customers alike, but heterogeneous FPGA-CPU microarchitectures require reassessment of common assumptions about isolation and security boundaries, as they introduce new attack vectors and vulnerabilities. The FPGAs now available from major cloud services use technologies like direct memory access and coherent caching to offer high-throughput, low-latency, and highly scalable FPGA-FPGA and FPGA-CPU coprocessing for heavy workloads. This chapter explores how FPGAs with access to these microarchitectural features can accelerate attacks against the host memory. It points out cache timing side channels and demonstrates a performant Rowhammer attack against a well-known RSA variant through direct memory access.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

über 102.000 Bücher
über 537 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Finance + Banking
Management + Führung
Marketing + Vertrieb
Maschinenbau + Werkstoffe
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 390 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Maschinenbau + Werkstoffe

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 340 Zeitschriften

aus folgenden Fachgebieten:

Bauwesen + Immobilien
Business IT + Informatik
Finance + Banking
Management + Führung
Marketing + Vertrieb
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Vorheriges Kapitel Cross-board Power-Based FPGA, CPU, and GPU Covert Channels

Nächstes Kapitel Fingerprinting and Mapping Cloud FPGA Infrastructures

A lower level cache is called inclusive of a higher level cache if all cache lines present in the higher level cache are always present in the lower level cache.

The PAC is intended to support 400 MHz clock speed, but the current version of the Intel Acceleration Stack (IAS) has a bug that halves the clock speed.

Each average is computed over 200 measurements.

This was verified by an Intel employee in personal communication.

The time to send all the requests is not precisely the time to complete all the requests, but it is very close for sufficiently high numbers of requests. The FPGA has a transaction buffer that holds up to 64 transactions after they have been sent by the AFU. The buffer does take some time to clear, but the additional time is negligible for our performance measurements of millions of requests.

There are several reasons why this could be the case. Some DRAM is simply more resistant to Rowhammer by its physical nature. Error correcting code (ECC) memory is capable of reversing some memory faults in real time. DDR4 memory, which can be found in this system, sometimes has hardware features to block Rowhammer style attacks [35]. It is impossible to say whether the DRAM in this system has any particular defenses in place without access to the hardware or BIOS. Some methods have been developed to circumvent these protections [15, 18], but for this work we focus on DDR3, where flips are more reliable and the advantage of the FPGA is easier to demonstrate.

More specifically, DDR3 and DDR4 specifications indicate 64 ms as the maximum allowable time between DRAM row refreshes.

This process is not the software process directly communicating with the AFU over OPAE/CCI-P.

This is a worst-case scenario where every transmitted bit is a ‘1’-bit. For a random message, this estimation increases as ‘0‘-bits do not fill the buffer, allowing for faster transmission.

Alibaba Cloud. (2019). FPGA-based compute-optimized instance families. https://www.alibabacloud.com/help/doc-detail/108504.html. Accessed 2023-05-23.

Amazon Web Services. (2017). Amazon EC2 F1 instances. https://aws.amazon.com/ec2/instance-types/f1/. Accessed 2023-05-23.

Apecechea, G. I., Eisenbarth, T., & Sunar, B. (2015). S$A: A shared cache attack that works across cores and defies VM sandboxing—and its application to AES. In 2015 IEEE symposium on security and privacy, SP 2015, San Jose, CA, USA, May 17–21, 2015 (pp. 591–604). IEEE Computer Society. https://doi.org/10.1109/SP.2015.42.

Aumüller, C., Bier, P., Fischer, W., Hofreiter, P., & Seifert, J. (2002). Fault attacks on RSA with CRT: Concrete results and practical countermeasures. In: B. S. K. Jr., Ç. K. Koç, & C. Paar (Eds.), Cryptographic hardware and embedded systems—CHES 2002, 4th international workshop, Redwood Shores, CA, USA, August 13–15, 2002. Revised Papers, Lecture Notes in Computer Science (Vol. 2523, pp. 260–275). Springer. https://doi.org/10.1007/3-540-36400-5_20.

Benger, N., van de Pol, J., Smart, N. P., & Yarom, Y. (2014). “Ooh Aah... Just a Little Bit” : A small amount of side channel can go a long way. In: L. Batina, & M. Robshaw (Eds.), Proceedings of the Cryptographic hardware and embedded systems—CHES 2014—16th International Workshop, Busan, South Korea, September 23–26, 2014. Lecture Notes in Computer Science (Vol. 8731, pp. 75–92). Springer. https://doi.org/10.1007/978-3-662-44709-3_5.

Bhattacharya, S., & Mukhopadhyay, D. (2016). Curious case of Rowhammer: Flipping secret exponent bits using timing analysis. In B. Gierlichs, & A. Y. Poschmann (Eds.), Proceedings of the Cryptographic hardware and embedded systems—CHES 2016—18th international conference, Santa Barbara, CA, USA, August 17–19, 2016. Lecture notes in computer science (Vol. 9813, pp. 602–624). Springer. https://doi.org/10.1007/978-3-662-53140-2_29.

Bhattacharya, S., & Mukhopadhyay, D. (2018). Advanced fault attacks in software: Exploiting the Rowhammer bug. In S. Patranabis, & D. Mukhopadhyay (Eds.), Fault tolerant architectures for cryptography and hardware security, computer architecture and design methodologies (pp. 111–135). Springer Singapore. https://doi.org/10.1007/978-981-10-1387-4_6.

Boneh, D., DeMillo, R. A., & Lipton, R. J. (1997). On the importance of checking cryptographic protocols for faults (extended abstract). In W. Fumy (Ed.), Proceeding of the advances in Cryptology—EUROCRYPT ’97, international conference on the theory and application of cryptographic techniques, Konstanz, Germany, May 11–15, 1997. Lecture notes in computer science (Vol. 1233, pp. 37–51). Springer. https://doi.org/10.1007/3-540-69053-0_4.

Briongos, S., Irazoqui, G., Malagón, P., & Eisenbarth, T. (2018). CacheShield: Detecting cache attacks through self-observation. In Z. Zhao, G. Ahn, R. Krishnan, & G. Ghinita (Eds.), Proceedings of the eighth ACM conference on data and application security and privacy, CODASPY 2018, Tempe, AZ, USA, March 19–21, 2018 (pp. 224–235). ACM. https://doi.org/10.1145/3176258.3176320.

10.

Brumley, B. B., & Hakala, R. M. (2009). Cache-timing template attacks. In: M. Matsui (Ed.), Proceedings of the advances in cryptology—ASIACRYPT 2009, 15th international conference on the theory and application of cryptology and information security, Tokyo, Japan, December 6–10, 2009. Lecture notes in computer science (Vol. 5912, pp. 667–684). Springer. https://doi.org/10.1007/978-3-642-10366-7_39.

11.

Carré, S., Desjardins, M., Facon, A., & Guilley, S. (2018). OpenSSL Bellcore’s protection helps fault attack. In M. Novotný, N. Konofaos, & A. Skavhaug (Eds.), 21st Euromicro conference on digital system design, DSD 2018, Prague, Czech Republic, August 29–31, 2018 (pp. 500–507). IEEE Computer Society. https://doi.org/10.1109/DSD.2018.00089.

12.

Chiappetta, M., Savas, E., & Yilmaz, C. (2016). Real time detection of cache-based side-channel attacks using hardware performance counters. Applied Soft Computing, 49, 1162–1174. https://doi.org/10.1016/j.asoc.2016.09.014.CrossRef

13.

Faict, T., D’Hollander, E. H., & Goossens, B. (2019). Mapping a guided image filter on the HARP reconfigurable architecture using OpenCL. Algorithms, 12(8), 149. https://doi.org/10.3390/a12080149.CrossRef

14.

Frigo, P., Giuffrida, C., Bos, H., & Razavi, K. (2018). Grand Pwning Unit: Accelerating microarchitectural attacks with the GPU. In Proceedings of the 2018 IEEE symposium on security and privacy, SP 2018, 21–23 May 2018, San Francisco, California, USA (pp. 195–210). IEEE Computer Society. https://doi.org/10.1109/SP.2018.00022.

15.

Frigo, P., Vannacci, E., Hassan, H., van der Veen, V., Mutlu, O., Giuffrida, C., Bos, H., & Razavi, K. (2020). TRRespass: Exploiting the many sides of target row refresh. In 2020 IEEE symposium on security and privacy, SP 2020, San Francisco, CA, USA, May 18–21, 2020 (pp. 747–762). IEEE. https://doi.org/10.1109/SP40000.2020.00090.

16.

Green, M., Lima, L. R., Zankl, A., Irazoqui, G., Heyszl, J., & Eisenbarth, T. (2017). AutoLock: Why cache attacks on ARM are harder than you think. In E. Kirda, & T. Ristenpart (Eds.), 26th USENIX security symposium, USENIX security 2017, Vancouver, BC, Canada, August 16–18, 2017 (pp. 1075–1091). USENIX Association. https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/green.

17.

Gruss, D., Lettner, J., Schuster, F., Ohrimenko, O., Haller, I., & Costa, M. (2017). Strong and efficient cache side-channel protection using hardware transactional memory. In E. Kirda, & T. Ristenpart (Eds.), 26th USENIX security symposium, USENIX security 2017, Vancouver, BC, Canada, August 16–18, 2017 (pp. 217–233). USENIX Association. https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/gruss.

18.

Gruss, D., Lipp, M., Schwarz, M., Genkin, D., Juffinger, J., O’Connell, S., Schoechl, W., & Yarom, Y. (2018). Another flip in the wall of Rowhammer defenses. In Proceedings of the 2018 IEEE symposium on security and privacy, SP 2018, 21–23 May 2018, San Francisco, California, USA (pp. 245–261). IEEE Computer Society. https://doi.org/10.1109/SP.2018.00031.

19.

Gruss, D., Maurice, C., & Mangard, S. (2016). Rowhammer.js: A remote software-induced fault attack in JavaScript. In J. Caballero, U. Zurutuza, & R. J. Rodríguez (Eds.), Proceedings of the detection of intrusions and malware, and vulnerability assessment—13th international conference, DIMVA 2016, San Sebastián, Spain, July 7–8, 2016. Lecture notes in computer science (vol. 9721, pp. 300–321). Springer. https://doi.org/10.1007/978-3-319-40667-1_15.

20.

Gruss, D., Maurice, C., Wagner, K., & Mangard, S. (2016). Flush+Flush: A fast and stealthy cache attack. In J. Caballero, U. Zurutuza, & R. J. Rodríguez (Eds.), Proceedings of the detection of intrusions and malware, and vulnerability assessment—13th international conference, DIMVA 2016, San Sebastián, Spain, July 7–8, 2016. Lecture notes in computer science (Vol. 9721, pp. 279–299). Springer. https://doi.org/10.1007/978-3-319-40667-1_14.

21.

Gülmezoglu, B., Eisenbarth, T., & Sunar, B. (2017). Cache-based application detection in the cloud using machine learning. In R. Karri, O. Sinanoglu, A. Sadeghi, & X. Yi (Eds.), Proceedings of the 2017 ACM Asia conference on computer and communications security, AsiaCCS 2017, Abu Dhabi, United Arab Emirates, April 02–06, 2017 (pp. 288–300. ACM). https://doi.org/10.1145/3052973.3053036.

22.

Gülmezoglu, B., Moghimi, A., Eisenbarth, T., & Sunar, B. (2019). FortuneTeller: Predicting microarchitectural attacks via unsupervised deep learning. CoRR abs/1907.03651. http://arxiv.org/abs/1907.03651.

23.

Gülmezoglu, B., Zankl, A., Eisenbarth, T., & Sunar, B. (2017). PerfWeb: How to violate web privacy with hardware performance events. In S. N. Foley, D. Gollmann, & E. Snekkenes (Eds.), Computer security—ESORICS 2017—22nd European symposium on research in computer security, Oslo, Norway, September 11–15, 2017, Proceedings, Part II. Lecture notes in computer science (Vol. 10493, pp. 80–97). Springer. https://doi.org/10.1007/978-3-319-66399-9_5.

24.

Hund, R., Willems, C., & Holz, T. (2013). Practical timing side channel attacks against kernel space ASLR. In 20th Annual network and distributed system security symposium, NDSS 2013, San Diego, California, USA, February 24–27, 2013. The Internet Society. https://www.ndss-symposium.org/ndss2013/practical-timing-side-channel-attacks-against-kernel-space-aslr.

25.

Inci, M. S., Gülmezoglu, B., Apecechea, G. I., Eisenbarth, T., & Sunar, B. (2015). Seriously, get off my cloud! cross-VM RSA key recovery in a public cloud. IACR Cryptol. ePrint Arch. (p. 898). http://eprint.iacr.org/2015/898.

26.

Inci, M. S., Gülmezoglu, B., Irazoqui, G., Eisenbarth, T., & Sunar, B. (2016). Cache attacks enable bulk key recovery on the cloud. In: B. Gierlichs, & A. Y. Poschmann (Eds.). Proceedings of the Cryptographic hardware and embedded systems—CHES 2016—18th international conference, Santa Barbara, CA, USA, August 17–19, 2016. Lecture notes in computer science (Vol. 9813, pp. 368–388). Springer. https://doi.org/10.1007/978-3-662-53140-2_18.

27.

Intel (2017). Open programmable acceleration engine (1.1.2 ed.). Accessed 2023-05-23.

28.

Intel (2018). Acceleration Stack for Intel Xeon CPU with FPGAs Core Cache Interface (CCI-P) Reference Manual (1.2 ed.).

29.

Intel (2020). Intel programmable acceleration card (PAC) with Intel Arria 10 GX FPGA data sheet. https://www.intel.com/content/www/us/en/docs/programmable/683226/current/introduction-rush-creek.html. Accessed 2023-05-22.

30.

Intel (2022). Intel Virtualization Technology for Directed I/O. Rev. 4.0.

31.

Intel Labs (2021). FPGA accelerators. https://wiki.intel-research.net/FPGA.html#fpga-system-classes. Accessed 2023-05-22.

32.

Intel Labs (2021). IL academic compute environment documentation. https://wiki.intel-research.net/. Accessed 2023-05-22.

33.

Irazoqui, G., Eisenbarth, T., & Sunar, B. (2015). Systematic reverse engineering of cache slice selection in intel processors. In 2015 Euromicro conference on digital system design, DSD 2015, Madeira, Portugal, August 26–28, 2015 (pp. 629–636). IEEE Computer Society. https://doi.org/10.1109/DSD.2015.56.

34.

Irazoqui, G., Eisenbarth, T., & Sunar, B. (2016). Cross processor cache attacks. In X. Chen, X. Wang, & X. Huang (Eds.), Proceedings of the 11th ACM Asia conference on computer and communications security, AsiaCCS 2016, Xi’an, China, May 30–June 3, 2016 (pp. 353–364). ACM. https://doi.org/10.1145/2897845.2897867.

35.

JC-42.6 Low Power Memories Committee (2017). Low Power Double Data Rate 4 (LPDDR4). In Standard JESD209-4B, JEDEC solid state technology association.

36.

Kim, T., Peinado, M., Mainar-Ruiz, G. (2012). STEALTHMEM: system-level protection against cache-based side channel attacks in the cloud. In T. Kohno (Ed.), Proceedings of the 21st USENIX security symposium, Bellevue, WA, USA, August 8–10, 2012 (pp. 189–204). USENIX Association. https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/kim.

37.

Kiriansky, V., Lebedev, I. A., Amarasinghe, S. P., Devadas, S., & Emer, J. S. (2018). DAWG: A defense against cache timing attacks in speculative execution processors. In 51st Annual IEEE/ACM international symposium on microarchitecture, MICRO 2018, Fukuoka, Japan, October 20–24, 2018 (pp. 974–987). IEEE Computer Society. https://doi.org/10.1109/MICRO.2018.00083.

38.

Kurth, M., Gras, B., Andriesse, D., Giuffrida, C., Bos, H., & Razavi, K. (2020). NetCAT: Practical cache attacks from the network. In 2020 IEEE symposium on security and privacy, SP 2020, San Francisco, CA, USA, May 18–21, 2020, pp. 20–38. IEEE. https://doi.org/10.1109/SP40000.2020.00082.

39.

Lipp, M., Gruss, D., Spreitzer, R., Maurice, C., Mangard, S.: ARMageddon: Cache attacks on mobile devices. In T. Holz, & S. Savage (Eds.), 25th USENIX security symposium, USENIX security 16, Austin, TX, USA, August 10–12, 2016, pp. 549–564. USENIX Association (2016). https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/lipp.

40.

Liu, F., Ge, Q., Yarom, Y., McKeen, F., Rozas, C. V., Heiser, G., Lee, R. B. (2016). CATalyst: Defeating last-level cache side channel attacks in cloud computing. In 2016 IEEE international symposium on high performance computer architecture, HPCA 2016, Barcelona, Spain, March 12–16, 2016 (pp. 406–418). IEEE Computer Society. https://doi.org/10.1109/HPCA.2016.7446082.

41.

Liu, F., Yarom, Y., Ge, Q., Heiser, G., & Lee, R. B. (2015). Last-level cache side-channel attacks are practical. In 2015 IEEE symposium on security and privacy, SP 2015, San Jose, CA, USA, May 17–21, 2015 (pp. 605–622). IEEE Computer Society. https://doi.org/10.1109/SP.2015.43.

42.

Maurice, C., Weber, M., Schwarz, M., Giner, L., Gruss, D., Boano, C. A., Mangard, S., & Römer, K. (2017). Hello from the other side: SSH over robust cache covert channels in the cloud. In 24th annual network and distributed system security symposium, NDSS 2017, San Diego, California, USA, February 26–March 1, 2017. The Internet Society. https://www.ndss-symposium.org/ndss2017/ndss-2017-programme/hello-other-side-ssh-over-robust-cache-covert-channels-cloud/.

43.

Moghimi, A., Irazoqui, G., & Eisenbarth, T. (2017). CacheZoom: How SGX amplifies the power of cache attacks. In W. Fischer, & N. Homma (Eds.), Proceedings of the cryptographic hardware and embedded systems—CHES 2017—19th international conference, Taipei, Taiwan, September 25–28, 2017. Lecture Notes in Computer Science (Vol. 10529, pp. 69–90). Springer. https://doi.org/10.1007/978-3-319-66787-4_4.

44.

Mulnix, D. (2017). Intel Xeon processor scalable family technical overview. https://www.intel.com/content/www/us/en/developer/articles/technical/xeon-processor-scalable-family-technical-overview.html. Accessed 2023-05-22.

45.

Oren, Y., Kemerlis, V. P., Sethumadhavan, S., & Keromytis, A. D. (2015). The spy in the sandbox: Practical cache attacks in JavaScript and their implications. In I. Ray, N. Li, & C. Kruegel (Eds.), Proceedings of the 22nd ACM SIGSAC conference on computer and communications security, Denver, CO, USA, October 12–16, 2015 (pp. 1406–1418). ACM. https://doi.org/10.1145/2810103.2813708.

46.

Osvik, D. A., Shamir, A., & Tromer, E. (2006). Cache attacks and countermeasures: The case of AES. In D. Pointcheval (Ed.), Proceedings of the Topics in Cryptology—CT-RSA 2006, The Cryptographers’ track at the RSA conference 2006, San Jose, CA, USA, February 13–17, 2006. Lecture notes in computer science (Vol. 3860, pp. 1–20). Springer. https://doi.org/10.1007/11605805_1.

47.

Pessl, P., Gruss, D., Maurice, C., Schwarz, M., & Mangard, S. (2016). DRAMA: exploiting DRAM addressing for cross-CPU attacks. In T. Holz, & S. Savage (Eds.), 25th USENIX security symposium, USENIX security 16, Austin, TX, USA, August 10–12, 2016 (pp. 565–581). USENIX Association. https://www.usenix.org/conference/usenixsecurity16/technical-sessions/presentation/pessl.

48.

Purnal, A., Turan, F., & Verbauwhede, I.: Double trouble: Combined heterogeneous attacks on non-inclusive cache hierarchies. In K. R. B. Butler, & K. Thomas (Eds.), 31st USENIX security symposium, USENIX security 2022, Boston, MA, USA, August 10–12, 2022 (pp. 3647–3664). USENIX Association (2022). https://www.usenix.org/conference/usenixsecurity22/presentation/purnal.

49.

Ristenpart, T., Tromer, E., Shacham, H., & Savage, S. (2009). Hey, you, get off of my cloud: Exploring information leakage in third-party compute clouds. In E. Al-Shaer, S. Jha, & A. D. Keromytis (Eds.), Proceedings of the 2009 ACM conference on computer and communications security, CCS 2009, Chicago, Illinois, USA, November 9–13, 2009 (pp. 199–212). ACM. https://doi.org/10.1145/1653662.1653687.

50.

Schwarz, M. (2019). PTEditor: A small library to modify all page-table levels of all processes from user space for x86_64 and ARMv8. https://github.com/misc0110/PTEditor. Version 738f42e, accessed 2023-05-22.

51.

Seaborn, M., & Dullien, T. (2015). Exploiting the DRAM Rowhammer bug to gain kernel privileges. Black Hat USA, 18, 71. https://www.blackhat.com/docs/us-15/materials/us-15-Seaborn-Exploiting-The-DRAM-Rowhammer-Bug-To-Gain-Kernel-Privileges.pdf.

52.

Taram, M., Venkat, A., & Tullsen, D. M. (2020). Packet chasing: Spying on network packets over a cache side-channel. In 47th ACM/IEEE annual international symposium on computer architecture, ISCA 2020, Valencia, Spain, May 30–June 3, 2020 (pp. 721–734). IEEE. https://doi.org/10.1109/ISCA45697.2020.00065.

53.

Tiemann, T., Weissman, Z., Eisenbarth, T., & Sunar, B.: IOTLB-SC: An accelerator-independent leakage source in modern cloud systems. In: Proceedings of the 2023 ACM Asia conference on computer and communications security, AsiaCCS 2023, Melbourne, Australia, July 10–14, 2023. ACM (2023). https://doi.org/10.1145/3579856.3582838.

54.

Tsunoo, Y., Saito, T., Suzaki, T., Shigeri, M., & Miyauchi, H. (2003). Cryptanalysis of DES implemented on computers with cache. In C. D. Walter, Ç. K. Koç, & C. Paar (Eds.) Proceedings of the Cryptographic hardware and embedded systems—CHES 2003, 5th international workshop, Cologne, Germany, September 8–10, 2003. Lecture notes in computer science (Vol. 2779, pp. 62–76). Springer. https://doi.org/10.1007/978-3-540-45238-6_6.

55.

van der Veen, V., Fratantonio, Y., Lindorfer, M., Gruss, D., Maurice, C., Vigna, G., Bos, H., Razavi, K., & Giuffrida, C.: Drammer: Deterministic Rowhammer attacks on mobile platforms. In E. R. Weippl, S. Katzenbeisser, C. Kruegel, A. C. Myers, S. Halevi (Eds.), Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, Vienna, Austria, October 24–28, 2016, pp. 1675–1689. ACM (2016). https://doi.org/10.1145/2976749.2978406.

56.

Vila, P., Köpf, B., & Morales, J. F. (2019). Theory and practice of finding eviction sets. In 2019 IEEE symposium on security and privacy, SP 2019, San Francisco, CA, USA, May 19–23, 2019 (pp. 39–54). IEEE. https://doi.org/10.1109/SP.2019.00042.

57.

Witteman, M. F., van Woudenberg, J. G. J., & Menarini, F.: Defeating RSA multiply-always and message blinding countermeasures. In A. Kiayias (Ed.), Proceedings of the topics in cryptology—CT-RSA 2011—the Cryptographers’ track at the RSA conference 2011, San Francisco, CA, USA, February 14–18, 2011. Lecture notes in computer science (Vol. 6558, pp. 77–88). Springer (2011). https://doi.org/10.1007/978-3-642-19074-2_6.

58.

Wu, Z., Xu, Z., & Wang, H. (2012). Whispers in the hyper-space: High-speed covert channel attacks in the cloud. In T. Kohno (Ed.), Proceedings of the 21th USENIX security symposium, Bellevue, WA, USA, August 8–10, 2012 (pp. 159–173). USENIX Association. https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/wu.

59.

Xilinx (2019). Accelerator Cards. https://www.xilinx.com/products/boards-and-kits/accelerator-cards.html. Accessed 2023-05-22.

60.

Yan, M., Sprabery, R., Gopireddy, B., Fletcher, C. W., Campbell, R. H., & Torrellas, J. (2019). Attack directories, not caches: Side channel attacks in a non-inclusive world. In 2019 IEEE symposium on security and privacy, SP 2019, San Francisco, CA, USA, May 19–23, 2019 (pp. 888–904). IEEE. https://doi.org/10.1109/SP.2019.00004.

61.

Yarom, Y., & Falkner, K. (2014). FLUSH+RELOAD: A high resolution, low noise, L3 cache side-channel attack. In K. Fu, & J. Jung (Eds.), Proceedings of the 23rd USENIX security symposium, San Diego, CA, USA, August 20–22, 2014 (pp. 719–732). USENIX Association. https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/yarom.

62.

Ye, Y., West, R., Cheng, Z., & Li, Y. (2014). COLORIS: a dynamic cache partitioning system using page coloring. In J. N. Amaral, & J. Torrellas (Eds.), International conference on parallel architectures and compilation, PACT ’14, Edmonton, AB, Canada, August 24–27, 2014 (pp. 381–392). ACM. https://doi.org/10.1145/2628071.2628104.

63.

Zhang, T., Zhang, Y., & Lee, R. B.: CloudRadar: A real-time side-channel attack detection system in clouds. In F. Monrose, M. Dacier, G. Blanc, & J. García-Alfaro (Eds.), Proceedings of the research in attacks, intrusions, and defenses—19th international symposium, RAID 2016, Paris, France, September 19–21, 2016. Lecture notes in computer science (Vol. 9854, pp. 118–140). Springer (2016). https://doi.org/10.1007/978-3-319-45719-2_6.

64.

Zhang, Y., Juels, A., Reiter, M. K., & Ristenpart, T. (2012). Cross-VM side channels and their use to extract private keys. In T. Yu, G. Danezis, & V. D. Gligor (Eds.), The ACM conference on computer and communications security, CCS’12, Raleigh, NC, USA, October 16–18, 2012 (pp. 305–316). ACM. https://doi.org/10.1145/2382196.2382230.

65.

Zhou, Z., Reiter, M. K., & Zhang, Y. (2016). A software approach to defeating side channels in last-level caches. In E. R. Weippl, S. Katzenbeisser, C. Kruegel, A. C. Myers, & S. Halevi (Eds.), Proceedings of the 2016 ACM SIGSAC conference on computer and communications security, Vienna, Austria, October 24–28, 2016 (pp. 871–882). ACM. https://doi.org/10.1145/2976749.2978324.

Titel: Microarchitectural Vulnerabilities Introduced, Exploited, and Accelerated by Heterogeneous FPGA-CPU Platforms
verfasst von: Thore Tiemann
Zane Weissman
Thomas Eisenbarth
Berk Sunar
Verlag: Springer International Publishing
Buch: Security of FPGA-Accelerated Cloud Computing Environments
Print ISBN: 978-3-031-45394-6

Electronic ISBN: 978-3-031-45395-3

Copyright-Jahr: 2024
DOI: https://doi.org/10.1007/978-3-031-45395-3_8

Neuer Inhalt

Bildnachweise

VDI-Icon, Profil Icon, inhalt2, Springer Professional Modul/© Springer Fachmedien Wiesbaden GmbH, Internationaler Motorenkongress/© [M] ATZlive | Chisnikov / Fotolia.com, Search Icon, Banner Hanser, Gardiner von Trapp/© Alpega Group, Benny Hahn/© ZEP GmbH, Customer Experience/© © oatawa / Getty Images / iStock, Zeitschrift Wissensmanagement Cover, PatentFit-Logo/© Springer Fachmedien Wiesbaden GmbH, 2023_Antrieb/© supervisuell, ATZ-Webinar: Prototypenfreie Entwicklung durch Offline- und Driver-in-the-Loop-HiL-Tests /© (c) VI-grade, chassis.tech plus 2023/© [M] ATZlive / TÜV SÜD PRODUCT SERVICE GMBH

Springer Professional

Abstract

Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Springer Professional "Technik"

Springer Professional "Wirtschaft"

Neuer Inhalt

Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.

Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.