Code integrity verification using cache memory monitoring. Issue 2 (4th March 2022)

• Record Type: Journal Article
• Authors: Shrivastava, Rajesh Kumar; Natu, Varun; Hota, Chittaranjan
• Is Part Of: Information security journal. Volume 31:Issue 2(2022)
• Page Start: 226
• Page End: 236
• Publication Date: 2022-03-04
• Subjects: Side-channel attack -- flush + Reload -- last-level cache -- cache memory; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1080/19393555.2021.1902592
• Languages: English
• ISSNs: 1939-3555

Abstract

ABSTRACT: This paper addresses the challenges of building a secure software system to prevent Man-at-the-End attacks. Ensuring the security of systems is challenging due to unfavorable constraints faced by the end-point host system. Constraints such as hostile environments leave the host system at the peril of would-be attackers. In this paper, we verify program integrity through L3 cache by monitoring the security-sensitive code points and verify them in memory. This paper uses a cache-based monitoring program to verify code integrity. In particular, we show that side-channel information can be used to encode the invariant of the program execution state. These invariants can be periodically and externally monitored as a proxy for application integrity. This monitoring system uses a sliding window scheme that can detect the violation of these invariant with high reliability. The proposed solution is transparent to the attacker and utilizes a side-channel technique (Flush + Reload) along with a sliding window scheme to monitor security-sensitive code and detect MATE attacks to prevent malicious manipulation of software.