Search

Microarchitectural data sampling (MDS) attacks leak secret data from the internal buffers of a processor to the attacker during transient execution. Because of the narrow window of transient execution, previous MDS attacks relied on repetitive sampling to obtain arbitrarily sized data from the buffer. However, as an MDS attacker cannot control the address for data leakage, such an approach significantly degrades the signal-to-noise ratio in the sampled data. In this paper, we propose a novel multibyte microarchitectural data sampling technique for performing MDS attacks. The proposed technique allows several continuous bytes to be captured in one execution without repetition of sampling. The implementation of the technique is quite challenging, because a transient execution window is not sufficiently large to allow multibyte sampling to be completed. We address this problem by leveraging a return stack buffer-based speculation technique, which originally was used for variants of Spectre-type attacks. We repurpose it to enlarge the transient execution window in our attack. Our implementations can capture data of up to 16 bytes in length in one execution from a line-fill buffer. To validate the effectiveness of the multibyte sampling technique, we demonstrate session key extraction attacks against secure network protocols. In particular, our objective is to extract AES-128 and AES-256 keys from TLS and SSH applications. To recover session keys in a postprocessing phase efficiently, we also propose a novel clustering-based search method that assembles the bytes of interest from the noisy sampled data. The experimental results show that our technique can successfully extract AES-128/256 session keys from victim applications with a probability of at least 98% and a reasonable search complexity.

Most modern multi-core CPUs are implemented in System-on-a-Chip (SoC), where CPU and integrated Graphics Processing Unit (iGPU) share physical memory and some microarchitectures. iGPUs provide horsepower required by computeintensive tasks, taking off CPU’s heavy workload. These tasks include rendering graphics, executing cryptographic or machine learning algorithms. While iGPU utilization has been expanded to various fields, now covering security-sensitive applications as well, possible security threats that could follow has not received enough attention yet. In this paper, we present a novel covert channel attack on heterogeneous processor platforms (CPU-iGPU) by using cache activity on LLC as a communication channel. To successfully mount this attack, iGPU-side trojan finds LLC eviction set on Shared Virtual Memory (SVM), which will create contention on target cache line of CPU-side spy. We successfully construct covert channel between a CPU process and an iGPU kernel, making it the first micro-architectural timing attack on Intel CPU-iGPU platform. We also evaluate performance of the attack in terms of channel bandwidth and bit error rate.

Transport Layer Security (TLS) protocol is often vulnerable to version downgrade attacks, where a man-in-the-middle attacker interferes with the handshake protocol and leads the communicating parties to fall back from a higher version of TLS to lower ones, which are typically provided for backward compatibility. In order to thwart the downgrade attack, several defense mechanisms are adopted in most of the recent TLS versions. However, there have not been many studies on analyzing what conditions are needed to guarantee the theoretical security, and understanding how they are implemented in practice in the era of TLS 1.3. To understand the current deployment of downgrade protection mechanisms and their security in the real world, in this paper, we investigated ten major web browsers in five operating systems with diverse implementation conditions of TLS clients and servers. As a result, we identified that two network stacks of Microsoft and Apple are vulnerable to downgrade attacks. We then demonstrate TLS sessions can be downgraded from TLS 1.3 to 1.0 by exploiting the vulnerability. Drawing on our experiment, we analyze the root cause for the vulnerability, and present several mitigation strategies.

As random numbers are used in various fields such as cryptography and computer science, research on such topic is essential. In this regard, studies on efficient random number generators have been conducted, and they involve developments of both hardware and software aspect of the generator. This paper focuses on investigation of software-based random number generators, which can be applied to resource-limited devices including embedded devices. Studies of different algorithms and analysis of their strength will provide a strong basis of newly developed random generator in future studies.

Memory deduplication is a technique that eliminates duplicate physical pages among virtual machines (VMs). Despite the advantage of efficient memory utilization in cloud computing, it leads to memory sharing-based side-channel attacks. Accordingly, most cloud service providers nowadays disable the memory deduplication on their servers to mitigate threats of the attacks, which comes at the cost of the efficiency loss. In this paper, we propose a novel mitigation technique for cloud computing environments against memory sharing-based side-channel attacks. Our technique converts vulnerable applications to secure ones that resist against the attacks. In particular, we utilize binary instrumentation to embed a secret random value inside an executable binary of the application. The random value will prevent memory sharing of security-sensitive applications with other from different security domains. On the other hand, the application-specific approach allows the systemwide memory deduplication, which preserves the efficient memory usage. We present the design and implementation of proposed mitigation as well as its evaluation results.

Network function virtualization takes advantage of virtualization technology to achieve flexibility in network service provisioning. However, it comes at the cost of security risks caused by cache side-channel attacks on virtual machines. In this study, we investigate the security impact of these attacks on virtualized network functions. In particular, we propose a novel cache-based reconnaissance technique against virtualized Linux-based firewalls. The proposed technique has significant advantages in the perspective of attackers. First, it enhances evasiveness against intrusion detection owing to the ability of source spoofing. Second, it allows inference on a wide variety of filtering rules. During experiment in VyOS, the proposed method could infer the firewall rules with an accuracy of more than 90% by using only a few dozen packets. We also present countermeasures to mitigate cache-based attacks on virtualized network functions.

Mail user agent (MUA) programs provide an integrated interface for email services. Many MUAs support email encryption functionality to ensure the confidentiality of emails. In practice, they encrypt the content of an email using email encryption standards such as OpenPGP or S/MIME, mostly implemented using GnuPG. Despite their widespread deployment, there has been insufficient research on their software structure and the security dependencies among the software components of MUA programs. In order to understand the security implications of the structures and analyze any possible vulnerabilities of MUA programs, we investigated a number of MUAs that support email encryption. As a result, we found severe vulnerabilities in a number of MUAs that allow cache side-channel attacks in virtualized desktop environments. Our analysis reveals that the root cause originates from the lack of verification and control over the third-party cryptographic libraries that they adopt. In order to demonstrate this, we implemented a cache side-channel attack on RSA in GnuPG and then conducted an evaluation of the vulnerability of 13 MUAs that support email encryption in Ubuntu 14.04, 16.04 and 18.04. Based on our experiment, we found that 10 of these MUA programs (representing approximately 77% of existing MUA programs) allow the installation of a vulnerable version of GnuPG, even when the latest version of GnuPG, which is secure against most cache side-channel attacks, is in use. In order to substantiate the importance of the vulnerability we discovered, we conducted a FLUSH+RELOAD attack on these MUA programs and demonstrated that the attack restored 92% of the bits of the 2048-bit RSA private key when the recipients read a single encrypted email.

Nowadays, various computing services are often hosted on cloud platforms for their availability and cost effectiveness. However, such services are frequently exposed to vulnerabilities. Therefore, many countermeasures have been invented to defend against software hacking. At the same time, more complicated attacking techniques have been created. Among them, code-reuse attacks are still an effective means of abusing software vulnerabilities. Although state-of-the-art address space layout randomization (ASLR) runtime-based solutions provide a robust way to mitigate code-reuse attacks, they have fundamental limitations; for example, the need for system modifications, and the need for recompiling source codes or restarting processes. These limitations are not appropriate for mission-critical services because a seamless operation is very important. In this paper, we propose a novel ASLR technique to provide memory rerandomization without interrupting the process execution. In addition, we describe its implementation and evaluate the results. In summary, our method provides a lightweight and seamless ASLR for critical service applications.

MUA (Mail User Agent) programs support email encryption functionality for providing confidentiality of the email contents. They encrypt email contents using email encryption standards such as OpenPGP or S/MIME, mostly implemented by GnuPG, or GPG in practice. In order to understand security implication of the structures and analyze any possible vulnerabilities of MUA programs, in this paper, we investigated practical MUAs supporting e-mail encryption. As a result, we found severe vulnerabilities in a list of MUAs that allow cache side-channel attacks in virtualized desktop environments. Our analysis reveals that the root cause originates from the lack of verification and control over third-party cryptographic libraries they adopt. In order to substantiate the importance of the vulnerability we found, we delivered FLUSH+RELOAD attack on those MUA programs and demonstrated that the attack restores 92% of the RSA private keys when recipients read a single encrypted email.

With the proliferation of new mobile devices, mobile cloud computing technology has emerged to provide rich computing and storage functions for mobile users. The explosive growth of mobile data has led to an increased demand for solutions that conserve storage resources. Data deduplication is a promising technique that eliminates data redundancy for storage. For mobile cloud storage services, enabling the deduplication of encrypted data is of vital importance to reduce costs and preserve data confidentiality. However, recently proposed solutions for encrypted deduplication lack the desired level of security and efficiency. In this paper, we propose a novel scheme for serverless efficient encrypted deduplication (SEED) in mobile cloud computing environments. Without the aid of additional servers, SEED ensures confidentiality, data integrity, and collusion resistance for outsourced data. The absence of dedicated servers increases the effectiveness of SEED for mobile cloud storage services, in which user mobility is essential. In addition, noninteractive file encryption with the support of lazy encryption greatly reduces latency in the file-upload process. The proposed indexing structure (D-tree) supports the deduplication algorithm and thus makes SEED much more efficient and scalable. Security and performance analyses prove the efficiency and effectiveness of SEED for mobile cloud storage services.

As FPGA demand grows, interest in FPGA security is also increasing. FPGA Reverse Engineering (RE) in the ISE Design Suite environment has been studied extensively, but FPGA RE in the Vivado Design Suite environment has not been practically studied at present. Particularly, there is no research on Programmable Interconnect Points (PIP). Since a method that correlates bitstream and XDL file is not applicable in Vivado environment, it requires complete analysis of FPGA structure and bitstream. So X-ray project [1] is used for structure analysis. In this paper, we analyze PIP bitstream configuration information based on X-ray project and propose PIP RE method in Vivado Design Suite environment based on it. The proposed method can be extended to full FPGA RE in Vivado Design Suite environment through further studies.

Cache side-channel attack extracts secret information by monitoring cache behavior of a victim. Normally, this attack targets a L3 cache which is shared between a spy and a victim. Hence, spy can learn about secret information without perception of the victim. To resist against this attack, many detection techniques have been proposed in the literature. However, those approaches have limitation since they do not operate in real time. In this paper, we propose a realtime detection technique against cache side-channel attacks. The proposed technique performs detection of cache side-channel attacks immediately after observing variation of CPU counters. For this, Intel PCM (Performance Counter Monitor) and machine learning algorithms are used to measure the value of CPU counters. Throughout the experiment, we found several PCM counters that show changes during the attack. Based on the observation, we implemented a detecting program by using these counters. Experimental results show that the proposed detection technique has good performance for real time detection in various environments.

Meltdown attack exploits out-of-order execution in modern micro-architectures to extract sensitive data in kernel space of operating systems. Out-of-order execution opens a window of transient execution in which unauthorized access to kernel space is allowed. The original Meltdown attack utilizes an OS signal handler and hardware transactional memory support (e.g., Intel TSX) to create transient executions. Both methods, however, restrict the effectiveness of the attack due to a large amount of system noise from signal handlers and a limited number of processors that support TSX. To overcome this limitation, we propose a new variant of Meltdown attack by using a return stack buffer (RSB). Without the aid of TSX, the proposed attack introduces lower level of noise than the signal handler-based method, which broadens the impact of Meltdown attacks to a wide range of processors. We conclude this paper by presenting several countermeasures against the proposed attack.

Data deduplication has attracted many cloud service providers (CSPs) as a way to reduce storage costs. Even though the general deduplication approach has been increasingly accepted, it comes with many security and privacy problems due to the outsourced data delivery models of cloud storage. To deal with specific security and privacy issues, secure deduplication techniques have been proposed for cloud data, leading to a diverse range of solutions and trade-offs. Hence, in this article, we discuss ongoing research on secure deduplication for cloud data in consideration of the attack scenarios exploited most widely in cloud storage. On the basis of classification of deduplication system, we explore security risks and attack scenarios from both inside and outside adversaries. We then describe state-of-the-art secure deduplication techniques for each approach that deal with different security issues under specific or combined threat models, which include both cryptographic and protocol solutions. We discuss and compare each scheme in terms of security and efficiency specific to different security goals. Finally, we identify and discuss unresolved issues and further research challenges for secure deduplication in cloud storage.

With the successful proliferation of data outsourcing services, security and privacy issues have drawn significant attention. Data authentication in particular plays an essential role in the storage of outsourced digital content and keeping it safe from modifications by inside or outside adversaries. In this paper, we focus on online data authentication using a Merkle (hash) tree to guarantee data integrity. By conducting in-depth diagnostics of the side channels of the Merkle tree-based approach, we explore novel solutions to improve the security and reliability of the maintenance of outsourced data. Based on a thorough review of previous solutions, we present a new method of inserting auxiliary random sources into the integrity verification proof on the prover side. This prevents the exposure of partial information within the tree structure and consequently releases restrictions on the number of verification execution, while maintaining desirable security and reliability of authentication for the long run. Based on a rigorous proof, we show that the proposed scheme maintains consistent reliability without being affected by continuous information leakage caused by repetitions of the authentication process. In addition, experimental results comparing with the proposed scheme with other state-of-the-art studies demonstrate its efficiency and practicality.

Data prefetching is a hardware-based optimization mechanism used in most of the modern microprocessors. It fetches data to the cache before it is needed. In this paper, we present a novel microarchitectural attack that exploits the prefetching mechanism. Our attack targets Instruction pointer (IP)-based stride prefetching in Intel processors. Stride prefetcher detects memory access patterns with a regular stride, which are likely to be found in lookup table-based cryptographic implementations. By monitoring the prefetching activities near the lookup table, attackers can extract sensitive information such as secret keys from victim applications. This kind of leakage from prefetching has never been considered in the design of constant time algorithm to prevent side-channel attacks. We show the potential of the proposed attack by applying it against the Elliptic Curve Diffie-Hellman (ECDH) algorithm built upon the latest version of OpenSSL library. To the best of our knowledge, this is the first microarchitectural side-channel attack exploiting the hardware prefetching of modern microprocessors.

To achieve high storage saving, data deduplication techniques are widely used in many practical cloud storage services, which removes redundant data and keeps only a single copy of them. However, secure data deduplication over encrypted data is challenging since encryption may result in different ciphertexts even when the original messages are the same. Thus, message-locked encryption (MLE) is proposed to solve this issue and demonstrates that it is secure under the unpredictable message set. Since block-level deduplication can achieve more fine-grained storage saving, several block-level deduplication schemes that support updatability are also vividly proposed. However, the previous updatable block-level MLE schemes are vulnerable against brute-force attack when the message set is predictable. Since the size of a block is typically much less than an arbitrary size of a file, the predictability problem is a very important pragmatic concern which should be addressed in the block-level deduplication literature. In this paper, thus, we propose a novel secure block-level deduplication scheme that guarantees efficient data update and brute-force attack resilience even when messages are predictable with the rigorous security proof. Also, our performance evaluation shows that additional time and bandwidth usage can be minimized as the size of a block increases.

Explosion of multimedia content brings forth the needs of efficient resource utilization using the state of the arts cloud computing technologies such as data deduplication. In the cloud computing environments, achieving both data privacy and integrity is the challenging issue for data outsourcing service. Proof of Storage with Deduplication (POSD) is a promising solution that addresses the issue for the cloud storage systems with deduplication enabled. However, the validity of the current POSD scheme stands on the strong assumption that all clients are honest in terms of generating their keys. We present insecurity of this approach under new attack model that malicious clients exploit dishonestly manipulated keys. We also propose an improved POSD scheme to mitigate our attack.

The smart grid is a promising electrical grid paradigm for enhancing flexibility and reliability in power transmission through two-way communications among grid entities. In the smart grid system, the privacy of usage information measured by individual smart meters has gained significant attention, owing to the possibility of personal information inference. Moreover, efficient and reliable power provisioning can be seriously impeded through illicit manipulations of aggregated data under the influence of malicious adversaries. Due to such potential risks, it becomes an important requirement for the smart grid to preserve privacy of metering data by secure aggregation and to authenticate the aggregated result in an efficient manner within large scale environments. From this perspective, this paper investigates the current status of security and privacy in smart grid systems and representative state-of-the-art studies in secure aggregation and authentication of metering data for future directions of a smart grid.

In this paper, we examine the online authentication method based on Merkle (hash) tree focusing on its reliability. Coming from side channels in online authentication, the effectiveness runs into danger in the long run. With consideration of effectiveness, we present a Merkle tree based online authentication resilient against side channels by obfuscating authentication proofs. Security and efficiency are analyzed to demonstrate the practicality of the proposed approach.

In cloud storage services, deduplication technology is commonly used to reduce the space and bandwidth requirements of services by eliminating redundant data and storing only a single copy of them. Deduplication is most effective when multiple users outsource the same data to the cloud storage, but it raises issues relating to security and ownership. Proof-of-ownership schemes allow any owner of the same data to prove to the cloud storage server that he owns the data in a robust way. However, many users are likely to encrypt their data before outsourcing them to the cloud storage to preserve privacy, but this hampers deduplication because of the randomization property of encryption. Recently, several deduplication schemes have been proposed to solve this problem by allowing each owner to share the same encryption key for the same data. However, most of the schemes suffer from security flaws, since they do not consider the dynamic changes in the ownership of outsourced data that occur frequently in a practical cloud storage service. In this paper, we propose a novel server-side deduplication scheme for encrypted data. It allows the cloud server to control access to outsourced data even when the ownership changes dynamically by exploiting randomized convergent encryption and secure ownership group key distribution. This prevents data leakage not only to revoked users even though they previously owned that data, but also to an honest-but-curious cloud storage server. In addition, the proposed scheme guarantees data integrity against any tag inconsistency attack. Thus, security is enhanced in the proposed scheme. The efficiency analysis results demonstrate that the proposed scheme is almost as efficient as the previous schemes, while the additional computational overhead is negligible.

Data deduplication is a technique that removes redundancy of data on the storage. For cloud storage services, enabling deduplication over encrypted data is of vital importance to achieve both cost savings and keeping data confidentiality simultaneously. Recently proposed solutions are not sufficient because of lacking desired level of security and efficiency. In this paper, we propose SEED, a novel scheme for serverless and efficient encrypted deduplication. Without aid of any additional servers, SEED provides strong confidentiality to the outsourced data. In addition, its non-interactive file encryption with support of lazy encryption greatly reduces latency in file uploading process. Security analysis and performance evaluations show the superior efficiency and effectiveness of SEED for cloud storage services.

With prevalence of remote storage services, data privacy issues become more serious owing to loss of control to outsourced data. In the meanwhile, the service providers tend to minimize storage utility costs. To minimize the storage costs while preserving data privacy, secure deduplication techniques have been proposed, which are categorized into client-side or server-side approaches. Client-side approach achieves storage and bandwidth savings at the same time but allows external adversaries to know existence of duplicates in the remote storage. On the contrary, server-side one prevents the adversaries from getting acknowledged but sacrifices network bandwidth savings. In fog computing, however, which is a new computing paradigm extending the cloud computing by outsourcing a centralized workload of the cloud to geographically distributed fog devices located at the edge of the networks, the previous deduplication schemes cannot guarantee efficiency improvement and privacy preservation simultaneously. In this paper, we present a simple but nontrivial solution of these contradictory issues in fog storage. The proposed hybrid secure deduplication protocol combines client-and server-side deduplications by taking untrustworthy fog storage environments into account. The client-side deduplication is applied in inter-network (i.e., cloud-fog network) communications to prevent network congestion at the network core, while the server-side deduplication is adopted in intra-network (i.e., user-fog network) communications to prevent information leakage via side channels for maximal data privacy. Performance and security analyses demonstrate the comparable efficiency of the proposed scheme with security enhancement.

Cloud storage provides scalable and low cost resources featuring economies of scale based on multi-tenant architecture. As the amount of data outsourced grows explosively, data deduplication, a technique that eliminates data redundancy, becomes essential. However, deduplication leads to problems with data confidentiality, thereby necessitating secure deduplication solutions. Server-aided encryption schemes have been proposed to achieve the strongest confidentiality but with the cost of managing a key server (KS). Previous schemes, however, are based on a centralized KS that uses only a single secret key assuming a single KS in the system. In cloud storage where multi-tenancy and scalability are crucial, such schemes degrade not only the effectiveness of deduplication but also the scalability with increasing users. In this paper, we extend server-aided encryption to a decentralized setting that consists of multiple KSs. The key idea of our proposed scheme is to construct an inter-KS deduplication algorithm, by which a cloud storage service provider can perform deduplication over ciphertexts from different KSs within a tenant or across tenants. This way, our scheme simultaneously offers flexibility of KS management and cross-tenant deduplication over encrypted data. The novelty of the approach is using a decentralized architecture that does not require any centralized entities for the coordination or pre-sharing of secrets among KSs. Therefore, it allows cloud storage services to offer high deduplication efficiency and scalability while preserving strong data confidentiality. We show the result of performance analysis on the proposed scheme by conducting extensive experiments. In addition, our security analysis demonstrate that the proposed scheme satisfies all desired security properties.