Coherence Attacks and Countermeasures in Interposer-Based Systems

TL;DR

This paper identifies a new security attack in interposer-based multi-core systems and proposes a secure interposer design that effectively counters this attack with minimal performance overhead.

Contribution

It introduces GETXspy, a novel coherence-based attack, and proposes an active interposer platform as a secure root of trust to mitigate such threats.

Findings

GETXspy can expose high-bandwidth covert channels in secure systems.

The proposed secure interposer prevents GETXspy and similar attacks.

System performance overhead is approximately 4%, decreasing with workload complexity.

Abstract

Industry is moving towards large-scale systems where processor cores, memories, accelerators, etc.\ are bundled via 2.5D integration. These various components are fabricated separately as chiplets and then integrated using an interconnect carrier, a so-called interposer. This new design style provides benefits in terms of yield as well as economies of scale, as chiplets may come from various third-party vendors, and be integrated into one sophisticated system. The benefits of this approach, however, come at the cost of new challenges for the system's security and integrity when many third-party component chiplets, some from not fully trusted vendors, are integrated. Here, we explore these challenges, but also promises, for modern interposer-based systems of cache-coherent, multi-core chiplets. First, we introduce a new, coherence-based attack, GETXspy, wherein a single compromised chiplet can expose a high-bandwidth side/covert-channel in an ostensibly secure system. We further show that prior art is insufficient to stop this new attack. Second, we propose using an active interposer as generic, secure-by-construction platform that forms a physical root of trust for modern 2.5D systems. Our scheme has limited overhead, restricted to the active interposer, allowing the chiplets and the coherence system to remain untouched. We show that our scheme prevents a wide range of attacks, including but not limited to our GETXspy attack, with little overhead on system performance, $\sim$4\%. This overhead reduces as workloads increase, ensuring scalability of the scheme.