Runahead execution is an effective microarchitectural level performance boosting technique. It removes the blocking load instruction with long latency and speculatively executes the subsequent instructions with little pipeline modifications. However, the nature of prefetching data and instructions creates potential security risks similar to Spectre and Meltdown. In this work, we present the first comprehensive analysis of the security implications of runahead execution and report a novel attack, named SPECRUN. SPECRUN exploits the unresolved branch predictions within nested speculative execution during runahead execution. It can manipulate the speculative execution window and hence eliminates the major limitation of Spectre-type attacks: the number of executable transient instructions is limited by the small reorder buffer size. Therefore, SPECRUN can improve the exploitability of transient attacks significantly. To demonstrate this, we implement a proof-of-concept attack that can successfully extract secrets from a victim process.We analyze existing defense techniques and propose new ones against SPECRUN. The effectiveness and overhead of these mitigation mechanisms are carefully discussed to shed light on the security vulnerabilities and defense before the adoption of runahead execution on current and future processors.

Runahead execution is a continuously evolving microarchitectural technique for processor performance. This paper introduces the first transient execution attack on the runahead execution, called SPECRUN, which exploits the unresolved branch prediction during runahead execution. We show that SPECRUN eliminates the limitation on the number of transient instructions posed by the reorder buffer size, enhancing the exploitability and harmfulness of the attack. We concretely demonstrate a proof-of-concept attack that causes leaking secrets from a victim process, validate the merit of SPECRUN, and design a secure runahead execution scheme. This paper highlights the need to consider the security of potential optimization techniques before implementing them in a processor.

Multi-process concurrency is effective in improving program efficiency and maximizing CPU utilization. The correct execution of concurrency is ensured by the mutual exclusion and synchronization mechanism (MESM) that manages the shared hardware and software resources. We propose MES-Attacks, a new set of software-controlled covert channel attacks based on MESM to transmit confidential information. MES-Attacks offer several advantages: 1) the covert channels are constructed at software level and can be deployed on any hardware; 2) the closed share of resource ensures the quality of the channels with low interference and makes them hard to be detected; and 3) the attack utilizes system’s software resources which are abound and hence difficult to isolate. We report the covert channels we have built with the following MESMs on Linux and Windows: flock, FileLockEX, Mutex, Semaphore, Event and WaitableTimer. Experimental results demonstrate that these covert channels can achieve transmission rate of 13.105 kb/s, 12.383 kb/s, and 6.552 kb/s, respectively in the scenarios of local, cross-sandbox and cross-virtual machine, all with bit error rate under 1%.

The mutual exclusion and synchronization mechanism (MESM) is a basic process management mechanism in modern operating systems. However, we first found that MESM has serious vulnerabilities. In this article, a new set of MESM-based software covert channels, named Mex+Sync, are proposed to transmit confidential information. Mex+Sync offer several advantages: 1) the covert channels are constructed at the software level and can be deployed on any hardware; 2) the closed shared resource ensures the quality of the channels with low interference and makes them hard to be detected; and 3) the attack utilizes the system’s software resources which abound and hence difficult to isolate. We build the covert channels on Linux and Windows with the following MESMs:flock,FileLockEX,Mutex,Semaphore,Event, andWaitableTimer. Experimental results demonstrate that these covert channels can achieve transmission rate of 13.105, 12.383, and 6.552 kb/s, respectively, in the scenarios of local, cross-sandbox and cross-virtual machine, all with bit error rate under 1%. Meanwhile, we carefully analyze and verify the impact of noise on channel performance.

Spectre attacks endanger most of CPUs, operating systems and cloud services due to the sharing of branch predic- tors in modern processors, while existing defenses fail to balance the security and overhead. This paper designs a lightweight and secure branch predictor (LS-BP), which provides lightweight hardware isolation for different branch entries of same-address- space and cross-address-space. Therefore, it is difficult for the attacker to establish branch conflicts. Experimental results show the average performance overhead is less than 3% while providing strong protection.

Physical unclonable function (PUF) is a promising lightweight hardware security primitive for resource-limited Internet-of-Things (IoT) devices. Strong PUFs are suitable for lightweight device authentication because it can generate quantities of challenge-response pairs. Unfortunately, while the machine learning (ML) techniques have benefited various areas, such as Internet, industrial automation, robotics and gaming, they pose a severe threat to PUFs by easily modelling their behavior. This article first shows that even a recently reported dual-mode PUF can be cloned by ML (prediction accuracy of up to 95%). To solve this issue, we propose a configurable tristate (CT) PUF which can flexibly perform as an arbiter PUF, a ring oscillator (RO) PUF, or a bistable ring (BR) PUF with a bitwise XOR-based mechanism to obfuscate the relationship between the challenge and the response, hence resisting the ML attacks. An authentication protocol for the use in IoT security is presented. The CT PUF is implemented on Xilinx ZedBoard FPGAs with placement and routing details described. The experimental results show that the modelling accuracy of logistic regression (LR), support vector machine (SVM), covariance matrix adaptation evolutionary strategies (CMA-ES), and artificial neural network (ANN) is close to 60% (50% as the ideal number in theory) while meeting the PUF requirements for uniformity, reliability, and uniqueness. The hardware overhead and power consumption are slight. The entire project has been open sourced.

It is a challenging task to deploy lightweight security protocols in resource-constrained IoT applications. A hardware-oriented lightweight authentication protocol based on device signature generated during voltage over-scaling (VOS) was recently proposed to address this issue. VOS-based authentication employs the computation unit such as adders to generate the process variation dependent error, which is combined with secret keys to create a two-factor authentication protocol. In this article, machine learning (ML)-based modeling attacks to break such authentication is presented. We also propose achallengeself-obfuscationstructure (CSoS) which employs previous challenges combined with keys or random numbers to obfuscate the current challenge for the VOS-based authentication to resist ML attacks. Experimental results show that ANN, RNN, and CMA-ES can clone the challenge-response behavior of VOS-based authentication with up to 99.65 percent prediction accuracy, while the prediction accuracy is less than 51.2 percent after deploying our proposed ML resilient technique. In addition, our proposed CSoS also shows good obfuscation ability for strong PUFs. Experimental results show that the modeling accuracy is below 54 percent when 106challenge-response pairs (CRPs) are collected to model the CSoS-based Arbiter PUF with ML attacks based on LR, SVM, ANN, RNN, and CMA-ES.

Central Processing Unit (CPU) is considered as the brain of a computer. If the CPU has vulnerabilities, the security of software running on it is difficult to be guaranteed. In recent years, various micro-architectural cache side-channel attacks on the CPU such as Spectre and Meltdown have appeared. They exploit contention on internal components of the processor to leak secret information between processes. This newly evolving research area has aroused significant interest due to the broad application range and harmfulness of these attacks. This article reviews recent research progress on micro-architectural cache side-channel attacks and defenses. First, the various micro-architectural cache side-channel attacks are classified and discussed. Then, the corresponding countermeasures are summarized. Finally, the limitations and future development trends are prospected.

Strong physical unclonable function (PUF) is a promising solution for device authentication in resource-constrained applications but vulnerable to machine learning (ML) attacks. In order to resist attack, many defenses have been proposed in recent years. However, these defenses incur high hardware overhead, degenerate reliability and are inefficient against advanced ML attacks such as approximation attacks. To address these issues, we propose a Random Set-based Obfuscation (RSO) for Strong PUFs to resist ML attacks. The basic idea is that several stable responses are derived from the PUF itself and pre-stored as the set for obfuscation in the testing phase, and then a true random number generator is used to select any two keys to obfuscate challenges and responses with XOR operations. When the number of challenge-response pairs (CRPs) collected by the attacker exceeds the given threshold, the set will be updated immediately. In this way, ML attacks can be prevented with extremely low hardware overhead. Experimental results show that for a 64 × 64 Arbiter PUF, when the size of set is 32 and even if 1 million CRPs are collected by attackers, the prediction accuracies of the several ML attacks we use are about 50% which is equivalent to the random guessing.