Language-based control and mitigation of timing channels

ACM SIGPLAN Notices

Volumn 47, Issue 6, 2012, Pages 99-109

  Zhang, Danfeng ^a   Askarov, Aslan ^b   Myers, Andrew C ^a  

^a School of Operations Research and Information Engineering   (United States)

^b HARVARD UNIVERSITY   (United States)

Author keywords

Information flow; Mitigation; Timing channels

Indexed keywords

AMOUNT OF INFORMATION; DESIGN OF HARDWARES; HARDWARE DESIGN; HARDWARE FEATURES; INFORMATION FLOWS; INSTRUCTION CACHES; MITIGATION; PROGRAMMING MODELS; TIMING CHANNELS;

COMPUTER PROGRAMMING;

HARDWARE;

EID: 84866417462     PISSN: 15232867     EISSN: None     Source Type: Journal    
DOI: 10.1145/2345156.2254078     Document Type: Conference Paper

References (39)

1. O. Aciiçmez. Yet another microarchitectural attack: Exploiting I-cache. In Proceedings of the ACM Workshop on Computer Security Architecture (CSAW '07), pages 11-18, 2007.
2. O. Aciiçmez, C. Koç, and J. Seifert. On the power of simple branch prediction analysis. In ASIACCS, pages 312-320, 2007.
3. J. Agat. Transforming out timing leaks. In Proc. 27th ACM Symp. on Principles of Programming Languages (POPL), pages 40-53, Boston, MA, January 2000.
4. A. Askarov, S. Hunt, A. Sabelfeld, and D. Sands. Termination-insensitive noninterference leaks more than just a bit. In ESORICS, pages 333-348, October 2008.
5. A. Askarov, D. Zhang, and A. C. Myers. Predictive black-box mitigation of timing channels. In ACM Conf. on Computer and Communications Security (CCS), pages 297-307, October 2010.
6. G. Barthe, T. Rezk, and M. Warnier. Preventing timing leaks through transactional branching instructions. Electronic Notes in Theoretical Computer Science, 153(2):33-55, 2006.
7. A. Bortz and D. Boneh. Exposing private information by timing web applications. In Proc. 16th Int'l World-Wide Web Conf., May 2007.
8. D. Brumley and D. Boneh. Remote timing attacks are practical. Computer Networks, January 2005.
9. D. C. Burger and T. M. Austin. The SimpleScalar tool set, version 3.0. Technical Report CS-TR-97-1342, University of Wisconsin, Madison, June 1997.
10. B. Coppens, I. Verbauwhede, K. D. Bosschere, and B. D. Sutter. Practical mitigations for timing-based side-channel attacks on modern x86 processors. IEEE Symposium on Security and Privacy, pages 45-60, 2009.
11. D. E. Denning. Cryptography and Data Security. Addison-Wesley, Reading, Massachusetts, 1982.
12. D. Devriese and F. Piessens. Noninterference through secure multi-execution. In IEEE Symposium on Security and Privacy, pages 109-124, May 2010.
13. J. Giffin, R. Greenstadt, P. Litwack, and R. Tibbetts. Covert messaging through TCP timestamps. Privacy Enhancing Technologies, Lecture Notes in Computer Science, 2482(2003):189-193, 2003.
14. D. Gullasch, E. Bangerter, and S. Krenn. Cache games -bringing access-based cache attacks on AES to practice. In IEEE Symposium on Security and Privacy, pages 490-505, 2011.
15. D. Hedin and D. Sands. Timing aware information flow security for a JavaCardlike bytecode. Electronic Notes in Theoretical Computer Science, 141(1):163-182, 2005.
16. M. Huisman, P. Worah, and K. Sunesen. A temporal logic characterisation of observational determinism. In Proc. 19th IEEE Computer Security Foundations Workshop, 2006.
17. V. Kashyap, B.Wiedermann, and B. Hardekopf. Timing-and termination-sensitive secure information flow: Exploring a new approach. In IEEE Symposium on Security and Privacy, pages 413-430, May 2011.
18. P. Kocher. Timing attacks on implementations of Diffie-Hellman, RSA, DSS, and other systems. In Advances in Cryptology -CRYPTO'96, August 1996.
19. J. Kong, O. Aciiçmez, J.-P. Seifert, and H. Zhou. Deconstructing new cache designs for thwarting software cache-based side channel attacks. In Proceedings of the 2nd ACM Workshop on Computer Security Architectures, pages 25-34, 2008.
20. B. Kopf and M. Durmuth. A provably secure and efficient countermeasure against timing attacks. In 2009 IEEE Computer Security Foundations, July 2009.
21. X. Li, M. Tiwari, J. Oberg, V. Kashyap, F. Chong, T. Sherwood, and B. Hardekopf. Caisson: A hardware description language for secure information flow. In ACM SIGPLAN Conference on Programming Language Design and Implementation, pages 109-120, 2011.
22. J. K. Millen. Covert channel capacity. In Proc. IEEE Symposium on Security and Privacy, Oakland, CA, April 1987.
23. D. Molnar, M. Piotrowski, D. Schultz, and D. Wagner. The program counter security model: Automatic detection and removal of control-flow side channel attacks. Cryptology ePrint archive: Report 2005/368, 2005.
24. D. Osvik, A. Shamir, and E. Tromer. Cache attacks and countermeasures: The case of AES. Topics in Cryptology-CT-RSA 2006, January 2006.
25. D. Page. Partitioned cache architecture as a side-channel defense mechanism. In Cryptology ePrint Archive, Report 2005/280, 2005.
26. A. Russo and A. Sabelfeld. Securing interaction between threads and the scheduler. In Proc. 19th IEEE Computer Security Foundations Workshop, 2006.
27. A. Sabelfeld and A. C. Myers. Language-based information-flow security. IEEE Journal on Selected Areas in Communications, 21(1):5-19, January 2003.
28. A. Sabelfeld and D. Sands. Probabilistic noninterference for multi-Threaded programs. In Proc. 13th IEEE Computer Security Foundations Workshop, pages 200-214. IEEE Computer Society Press, July 2000.
29. S. Sellke, C. Wang, and S. Bagchi. TCP/IP timing channels: Theory to implementation. In Proc. INFOCOM 2009, pages 2204-2212, January 2009.
30. G. Smith. A new type system for secure information flow. In Proc. 14th IEEE Computer Security Foundations Workshop, pages 115-125, June 2001.
31. G. Smith. On the foundations of quantitative information flow. Foundations of Software Science and Computational Structures, 5504:288-302, 2009.
32. G. Smith and D. Volpano. Secure information flow in a multi-Threaded imperative language. In Proc. 25th ACM Symp. on Principles of Programming Languages (POPL), pages 355-364, January 1998.
33. D. Volpano and G. Smith. Eliminating covert flows with minimum typings. In Proc. 10th IEEE Computer Security Foundations Workshop, pages 156-168, 1997.
34. Z. Wang and R. Lee. Covert and side channels due to processor architecture. In ACSAC '06, pages 473-482, 2006.
35. Z. Wang and R. Lee. New cache designs for thwarting software cache-based side channel attacks. In Proceedings of the 34th annual international symposium on computer architecture (ISCA '07), pages 494-505, 2007.
36. J. C. Wray. An analysis of covert timing channels. In Proc. IEEE Symposium on Security and Privacy, pages 2-7, 1991.
37. S. Zdancewic and A. C. Myers. Observational determinism for concurrent program security. In Proc. 16th IEEE Computer Security Foundations Workshop, pages 29-43, June 2003.
38. D. Zhang, A. Askarov, and A. C. Myers. Predictive mitigation of timing channels in interactive systems. In ACM Conf. on Computer and Communications Security (CCS), pages 563-574, October 2011.
39. D. Zhang, A. Askarov, and A. C. Myers. Language mechanisms for controlling and mitigating timing channels. Technical report, Cornell University, March 2012. http://hdl.handle.net/1813/28635.