A Benchmark Suite for Evaluating Caches' Vulnerability to Timing Attacks

TL;DR

This paper introduces a comprehensive benchmark suite with 1094 tests to evaluate the vulnerability of processor caches to timing-based attacks, aiding in designing more secure cache architectures.

Contribution

It presents 88 theoretical cache timing vulnerabilities and a new benchmark suite to automatically assess cache security against these threats.

Findings

Different processors show varying vulnerabilities to cache timing attacks.

The benchmark suite enables comparison of cache security across different hardware.

The Cache Timing Vulnerability Score quantifies how susceptible a cache is to timing attacks.

Abstract

Timing-based side or covert channels in processor caches continue to present a threat to computer systems, and they are the key to many of the recent Spectre and Meltdown attacks. Based on improvements to an existing three-step model for cache timing-based attacks, this work presents 88 Strong types of theoretical timing-based vulnerabilities in processor caches. To understand and evaluate all possible types of vulnerabilities in processor caches, this work further presents and implements a new benchmark suite which can be used to test to which types of cache timing-based attacks a given processor or cache design is vulnerable. In total, there are 1094 automatically-generated test programs which cover the 88 theoretical vulnerabilities. The benchmark suite generates the Cache Timing Vulnerability Score which can be used to evaluate how vulnerable a specific cache implementation is to different attacks. A smaller Cache Timing Vulnerability Score means the design is more secure, and the scores among different machines can be easily compared. Evaluation is conducted on commodity Intel and AMD processors and shows the differences in processor implementations can result in different types of attacks that they are vulnerable to. Beyond testing commodity processors, the benchmarks and the Cache Timing Vulnerability Score can be used to help designers of new secure processor caches evaluate their design's susceptibility to cache timing-based attacks.