论文标题
理解和推理投机执行攻击的新模型
New Models for Understanding and Reasoning about Speculative Execution Attacks
论文作者
论文摘要
Spectre和Meltdown攻击及其变体利用硬件性能优化功能来引起安全漏洞。通过秘密或侧渠道访问和泄漏秘密信息。新的攻击变体不断出现，我们没有一种系统的方法来捕获这些攻击的关键特征并评估它们成功或失败的原因。 在本文中，我们为推理投机执行攻击提供了一个新的攻击图模型。我们将攻击建模为有序的依赖图图，并证明如果它们之间缺少依赖边缘，则可能发生两个节点之间的竞赛条件。我们在资源访问及其事先授权操作之间定义了一个新概念“安全依赖性”。我们表明，缺失的安全依赖性等于授权和访问之间的种族条件，这是投机执行攻击的根本原因。我们展示了我们的攻击图如何模拟幽灵和崩溃攻击的详细示例，并且可以推广到到目前为止发布的所有攻击变体。该攻击模型对于识别新攻击和概括防御策略也非常有用。我们确定了具有不同绩效安全权衡的几种防御策略。我们表明，迄今为止提出的防御能力都在我们的一种防御策略下。我们还解释了如何构建攻击图，并将其指向工具设计人员的未来工作。
Spectre and Meltdown attacks and their variants exploit hardware performance optimization features to cause security breaches. Secret information is accessed and leaked through covert or side channels. New attack variants keep appearing and we do not have a systematic way to capture the critical characteristics of these attacks and evaluate why they succeed or fail. In this paper, we provide a new attack-graph model for reasoning about speculative execution attacks. We model attacks as ordered dependency graphs, and prove that a race condition between two nodes can occur if there is a missing dependency edge between them. We define a new concept, "security dependency", between a resource access and its prior authorization operation. We show that a missing security dependency is equivalent to a race condition between authorization and access, which is a root cause of speculative execution attacks. We show detailed examples of how our attack graph models the Spectre and Meltdown attacks, and is generalizable to all the attack variants published so far. This attack model is also very useful for identifying new attacks and for generalizing defense strategies. We identify several defense strategies with different performance-security tradeoffs. We show that the defenses proposed so far all fit under one of our defense strategies. We also explain how attack graphs can be constructed and point to this as promising future work for tool designers.
