Towards a Better Indicator for Cache Timing Channels

TL;DR

This paper proposes using cache occupancy as a more robust indicator for detecting cache timing channels, outperforming cache miss-based methods that can be spoofed by sophisticated adversaries.

Contribution

It introduces cache occupancy as a novel, more resilient metric for identifying cache timing channels, addressing limitations of previous miss-based detection techniques.

Findings

Cache occupancy patterns are harder to spoof than miss patterns.

Timing channels modulate cache access latency detectable via occupancy analysis.

Proposed method effectively detects advanced adversaries evading previous techniques.

Abstract

Recent studies highlighting the vulnerability of computer architecture to information leakage attacks have been a cause of significant concern. Among the various classes of microarchitectural attacks, cache timing channels are especially worrisome since they have the potential to compromise users' private data at high bit rates. Prior works have demonstrated the use of cache miss patterns to detect these attacks. We find that cache miss traces can be easily spoofed and thus they may not be able to identify smarter adversaries. In this work, we show that \emph{cache occupancy}, which records the number of cache blocks owned by a specific process, can be leveraged as a stronger indicator for the presence of cache timing channels. We observe that the modulation of cache access latency in timing channels can be recognized through analyzing pairwise cache occupancy patterns. Our experimental results show that cache occupancy patterns cannot be easily obfuscated even by advanced adversaries that successfully evade cache miss-based detection.