RAINCOAT: Randomization in Secure Nano-Scale Microarchitectures

Summary

In order to maintain the increasing chip performance while simultaneously advancing miniaturization, manufactures of modern memory- and processing units are increasingly relying on highly optimized, parallelized microarchitectures. With recent microarchitectural attacks like Rowhammer, Spectre and Meltown, it has been demonstrated, that such optimizations may cause unforeseen security risks. With the introduction of novel nano-technology, this trend towards miniaturization of hardware components will continue. The aim of the project is to investigate the security-relevant implications of new technology building blocks, such as NRAM, and to develop countermeasures for possible attack vectors. At the same time, existing security gaps, induced e.g. by branch predictors, are to be closed. Such measures must not cancel out the performance advantage of the new technologies. Therefore, the special focus lies on randomization-based countermeasures. These methods have already proven to be particularly suitable in the area of runtime attacks (e.g., buffer overflows).

Project Description

A large number of security problems in digital systems arise from the interfaces between hardware and software. During the last two years, attacks targeting these interfaces rapidly gained popularity and thus pose a continuously growing threat by undermining higher level security assumptions, in many cases bypassing also applied countermeasures. With increasing integration density on the hardware level and exacerbating security policies on the software level, the era of nano technology will open up new options for hardware-based attacks in the ongoing arms race between researchers and attackers.
The technical glue between hardware and software is defined by the microarchitectural level onwhich a variety of attacks have recently been discovered some of them at a very subtle layer. Concluding the current situation, it has turned out that a number of microarchitectural and side channel attacks are neglected by hard- and software manufacturers so far. In addition to that last few years have seen a tremendous increase in hardware based attacks. Transient attacks leverage speculative behavior of modern CPUs to bypass higher level process isolation techniques. Meltdown and Spectre, probably the most popular hardware based attacks, exploit speculative execution on branches and out-of-order execution techniques that are commonly implemented as performance optimizations in modern CPUs. With speculative execution, the processor aims to predict whether a conditional branch is taken or not. If anticipated correctly, the CPU saves execution time as instructions following the conditional branch can already be executed in parallel. If not, the processor discards the results of speculative execution and performs a rollback to the pre-branch state. Similarly, out-of-order execution allows the processor to rearrange the order of independent instructions and thus avoiding stalls that would occur if two consecutive instructions were dependent on each other. If an instruction raises an exception, prior out-of-order executed instructions might never be reached, requiring an execution rollback.While these performance enhancing methods have been available in mainstream CPUs for decades, it became only recently known that they induce major security challenges, mainly because speculatively executed instructions do have an impact on the microarchitectural cache state. Given the rise of microarchitectural and other hardware-oriented attacks and the lessons learned in recent years, we are in need of enhanced and dynamic security mechanisms that follow the upcoming transition from traditional technology towards nano electronics. However, the efficient implementation of accordingly adapted security countermeasures and randomization-augmented architectures is an open field of research. Goal of this project is the development, security analysis and evaluation of a novel randomizationaugmented microarchitecture with respect to the technological challenges in nano-scale technology, including the efficient generation, sharing and distribution of randomness.

Partner

The chair Secure Software Systems at the University of Duisburg Essen is mainly engaged in research on practical problems of system and software security. Special focus is on the development of security technologies against runtime attacks (software exploits) for different computer architectures. Further research areas are operating system security, trusted computing, mobile security and hardware-based software security.
The chair, headed by Prof. Dr.-Ing. Lucas Davi, is part of the DFG Cluster of Excellence CASA.

The chair Security Engineering at Ruhr-University Bochum researches in the field of IT security on hardware level.This includes the analysis of hardware platforms for security against side-channel and fault attacks as well as the development of secure hardware accelerators for different computer architectures. Further research areas are formal verification and quantum secure encryption methods.
The chair, headed by Prof. Dr.-Ing. Tim Güneysu, is part of the DFG Excellence Cluster CASA and the Horst Görtz Institute for IT Security (HGI).