side-channel attacks (brief introduction)danadach/security_fall... · side-channel attacks (brief...
TRANSCRIPT
![Page 1: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/1.jpg)
Side-Channel Attacks (Brief Introduction)
Presenter: Aria Shahverdi
12/6/2017
Cache
1
![Page 2: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/2.jpg)
How do we load data from Main Memory?
CPU
Main Memory
address
data
2
![Page 3: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/3.jpg)
Memory Locality
• Future memory accesses are near past memory accesses
• Memories take advantages of two locality • Temporal Locality: near in time
• We will often access the same data again very soon
• Spatial Locality: near in space/distance • Our next access is often very close to our last access (or recent accesses)
for(i = 0; i < 20; i++)
a[i] = a[i]*2;
a[0]
a[1]
a[2]
… 3
![Page 4: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/4.jpg)
Cache Architecture High Level
data
Cache
data
Main Memory
Cache
Set 1
Set 2
Set 64
CPU
Main Memory
address
4
![Page 5: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/5.jpg)
Set Associative Cache Architecture
line1 line2 line3 line4 line5 line6 line7 line8
line1 line2 line3 line4 line5 line6 line7 line8
line1 line2 line3 line4 line5 line6 line7 line8
line1 line2 line3 line4 line5 line6 line7 line8
Set 1
Set 2
Set 64
Main Memory
Cache
Line 1
Line 2
Line 3
Line 4
Line 5
Line 6
Line 7
Line 8
Line 1
Line 2
Set
1
Set 1
Set 2
Set 3
Set 64
8-way set associative Cache
Set
2
5
![Page 6: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/6.jpg)
Introduction to Cache Architecture
CPU
Main Memory
CPU
L1 Instruction Cache L1 Data Cache
L2 Cache
L3 Cache
6
![Page 7: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/7.jpg)
Cache Architecture (Summary)
• Unit of Memory in cache is a line
• A cache consists of multiple sets which stores fixed number of lines
• The number of lines in a set is called associativity • L1 is 8-way, L2 is 4-way, L3 is 12-way
• Last Level Cache (LLC) is inclusive • LLC contains copies of all of the data in the lower cache level
• Evicting data from LLC remove that data from all other cache levels
7
![Page 8: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/8.jpg)
Accessing Memory (Cache Hit)
CPU
Main Memory
Cache
Fast Access to Data
add
ress
data
8
![Page 9: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/9.jpg)
Accessing Memory (Cache Miss)
CPU
Main Memory
add
ress
data Cache
address
data data
Slow Access to Data
9
![Page 10: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/10.jpg)
Cache Hit vs. Miss Time Difference
• ≈10 Million measurement
Cache Hit
Cache Miss
Clock Cycle
Number of Occurrence
10
![Page 11: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/11.jpg)
Cache Attack Model
CPU
Main Memory
CPU CPU
Main Memory
CPU
11
: Attacker : Victim
![Page 12: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/12.jpg)
Some Cache Attack Technique
• Evict and Time
• Flush and Reload
• Prime and Probe
Set 1
Set 2
Set 3
Line 1
Line 2
Line
8
12
![Page 13: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/13.jpg)
Some Cache Attack Technique
• Evict and Time
• Flush and Reload
• Prime and Probe
13
![Page 14: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/14.jpg)
Evict and Time
1. Trigger encryption
2. Selectively manipulate the state of the cache (e.g. evict a full cache set)
3. Trigger encryption
4. Measure how long it took
5. Deduce what cache sets it accessed
6. Repeat step 1-4 to gain information on all the set the encryption accessed
14
![Page 15: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/15.jpg)
Evict and Time
1. Trigger encryption
2. Selectively manipulate the state of the cache (e.g. evict a full cache set)
3. Trigger encryption
4. Measure how long it took
5. Deduce what cache sets it accessed
6. Repeat step 1-4 to gain information on all the set the encryption accessed
15
![Page 16: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/16.jpg)
Evict and Time
1. Trigger encryption
2. Selectively manipulate the state of the cache (e.g. evict a full cache set)
3. Trigger encryption
4. Measure how long it took
5. Deduce what cache sets it accessed
6. Repeat step 1-4 to gain information on all the set the encryption accessed
16
![Page 17: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/17.jpg)
How do we fill a cache set?
• By Accessing some of the memory locations the corresponding locations in the cache is going to be filled.
• Main Challenge: which lines to access?
17
Main Memory Cache
![Page 18: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/18.jpg)
Evict and Time
1. Trigger encryption
2. Selectively manipulate the state of the cache (e.g. evict a full cache set)
3. Trigger encryption
4. Measure how long it took
5. Deduce what cache sets it accessed
6. Repeat step 1-4 to gain information on all the set the encryption accessed
18
![Page 19: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/19.jpg)
Evict and Time
1. Trigger encryption
2. Selectively manipulate the state of the cache (e.g. evict a full cache set)
3. Trigger encryption
4. Measure how long it took
5. Deduce what cache sets it accessed
6. Repeat step 1-4 to gain information on all the set the encryption accessed
It took almost the same amount time
19
![Page 20: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/20.jpg)
Evict and Time
1. Trigger encryption
2. Selectively manipulate the state of the cache (e.g. evict a full cache set)
3. Trigger encryption
4. Measure how long it took
5. Deduce what cache sets it accessed
6. Repeat step 1-4 to gain information on all the set the encryption accessed
20
![Page 21: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/21.jpg)
Evict and Time
1. Trigger encryption
2. Selectively manipulate the state of the cache (e.g. evict a full cache set)
3. Trigger encryption
4. Measure how long it took
5. Deduce what cache sets it accessed
6. Repeat step 1-4 to gain information on all the set the encryption accessed
21
![Page 22: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/22.jpg)
Evict and Time
1. Trigger encryption
2. Selectively manipulate the state of the cache (e.g. evict a full cache set)
3. Trigger encryption
4. Measure how long it took
5. Deduce what cache sets it accessed
6. Repeat step 1-4 to gain information on all the set the encryption accessed
22
![Page 23: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/23.jpg)
Evict and Time
1. Trigger encryption
2. Selectively manipulate the state of the cache (e.g. evict a full cache set)
3. Trigger encryption
4. Measure how long it took
5. Deduce what cache sets it accessed
6. Repeat step 1-4 to gain information on all the set the encryption accessed
Set 2 was accessed!!
23
![Page 24: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/24.jpg)
Some Cache Attack Technique
• Evict and Time
• Flush and Reload
• Prime and Probe
24
![Page 25: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/25.jpg)
Flush and Reload
• Exploits cache behavior to leak information on victim access to shared memory. • Shared libraries
• Memory de-duplication
• Spy monitors victim’s access to shared code • Spy can determine what victim does
• Spy can infer the data the victim operates on
25
![Page 26: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/26.jpg)
Flush and Reload
1. Flush memory line
2. Wait a bit
3. Measure time to Reload line
4. Repeat
26
![Page 27: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/27.jpg)
Flush and Reload
1. Flush memory line
2. Wait a bit
3. Measure time to Reload line
4. Repeat
27
![Page 28: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/28.jpg)
Flush a Line From Cache
CPU
Main Memory
CPU
flush
28
![Page 29: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/29.jpg)
Flush and Reload
1. Flush memory line
2. Wait a bit
3. Measure time to Reload line
4. Repeat
29
![Page 30: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/30.jpg)
Reload a Line From Cache
CPU
Main Memory
CPU
reload
No Access by Victim
30
![Page 31: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/31.jpg)
Flush and Reload
1. Flush memory line
2. Wait a bit
3. Measure time to Reload line
4. Repeat
Slow means no access by victim
31
![Page 32: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/32.jpg)
Reload a Line From Cache
CPU
Main Memory
CPU
reload
32
![Page 33: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/33.jpg)
Flush and Reload
1. Flush memory line
2. Wait a bit
3. Measure time to Reload line
4. Repeat
Fast means that victim accessed
33
![Page 34: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/34.jpg)
Some Cache Attack Technique
• Evict and Time
• Flush and Reload
• Prime and Probe
34
![Page 35: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/35.jpg)
Prime and Probe
1. Attacker fills a set with its own data by accessing some locations in memory
2. Victim Executes and evicts some of the cache lines
3. Attacker accesses those cache line and measure time
35
![Page 36: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/36.jpg)
Prime and Probe
1. Attacker fills a set with its own data by accessing some locations in memory
2. Victim Executes and evicts some of the cache lines
3. Attacker accesses those cache line and measure time
36
![Page 37: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/37.jpg)
Fill a cache set (In this example 2 sets)
CPU
Main Memory
CPU
Fill a set
37
![Page 38: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/38.jpg)
Prime and Probe
1. Attacker fills a set with its own data by accessing some locations in memory
2. Victim Executes and evicts some of the cache lines
3. Attacker accesses those cache line and measure time
38
![Page 39: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/39.jpg)
Victim Execution
CPU
Main Memory
CPU
Access some lines
39
: Attacker’s data
: Victim’s data
![Page 40: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/40.jpg)
Prime and Probe
1. Attacker fills a set with its own data by accessing some locations in memory
2. Victim Executes and evicts some of the cache lines
3. Attacker accesses those cache line and measure time
40
![Page 41: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/41.jpg)
Probe
CPU
Main Memory
CPU
Probe a set Probe a set
41
: Attacker’s data
: Victim’s data
![Page 42: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/42.jpg)
Prime and Probe
1. Attacker fills a set with its own data by accessing some locations in memory
2. Victim Executes and evicts some of the cache lines
3. Attacker accesses those cache line and measure time
Fast Access: Not accessed by the victim
Slow Access: Accessed by the victim
42
![Page 43: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/43.jpg)
How To Recover Secret Key?
• How do we compute 𝑏𝑒𝑚𝑜𝑑 𝑛? • Assume 𝑒 is secret information we
want to recover.
• Bit = 0 : Square
• Bit = 1 : Square + Multiply
The Sequence of operation will reveal the secret information.
SM
1
S S SM SM S S
0 0 1 1 0 0
43
![Page 44: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/44.jpg)
A Sample Measurement (Flush and Reload)
44
![Page 45: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/45.jpg)
Cache Attack on Database
• Monitoring L1 Instruction cache
• Each Line represents an access to a function
Time
Set
45
![Page 46: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/46.jpg)
Side Channel Attacks Examples
• Timing Attacks • Cache Attack
• Power Analysis Attack
• Electromagnetic Emissions
• Acoustic Emission
• Fault Attacks
46
![Page 47: Side-Channel Attacks (Brief Introduction)danadach/Security_Fall... · Side-Channel Attacks (Brief Introduction) Presenter: Aria Shahverdi 12/6/2017 Cache 1 . How do we load data from](https://reader034.vdocuments.mx/reader034/viewer/2022042300/5ecaf7bf31e6bc613a32ff6c/html5/thumbnails/47.jpg)
Thank You
47