Information leakage of sensitive data has become one of the fast growing concerns among computer users. With adversaries turning to hardware for exploits, caches are frequently a target for timing channels since they present different timing profiles for cache miss and hit latencies. Such timing channels operate by having an adversary covertly communicate secrets to a spy simply through modulating resource timing without leaving any physical evidence. In this article, we demonstrate a new vulnerability exposed by cache coherence protocols where adversaries could manipulate the coherence states on certain cache blocks to alter cache access timing and communicate secrets illegitimately. Our threat model assumes the trojan and spy can either exploit explicitly shared read-only physical pages (e.g., shared library code), or use memory deduplication feature to implicitly force create shared physical pages. We demonstrate a template that adversaries may use to construct covert timing channels through manipulating combinations of coherence states and data placement in different caches. We investigate several classes of cache coherence protocols, and observe that both directory-based and snoopy protocols can be subject to covert timing channel attacks. We identify that the root cause of the vulnerability to be the existence of access latency difference for cache lines in read-only cache coherence states: Exlusive and Shared. For defense, we propose a slightly modified cache coherence scheme that will enable the last level cache to directly respond to read data requests in these read-only coherence states, and avoid any latency difference that could enable timing channels.

中文翻译：

---

利用缓存一致性硬件的隐蔽时序通道：表征和防御

敏感数据的信息泄露已成为计算机用户快速增长的担忧之一。随着攻击者转向硬件进行漏洞利用，缓存经常成为计时通道的目标，因为它们为缓存未命中和命中延迟提供不同的计时配置文件。此类定时通道的运行方式是让对手只需通过调制资源定时而不留下任何物理证据就可以秘密地将秘密传达给间谍。在本文中，我们展示了缓存一致性协议暴露的一个新漏洞，攻击者可以在该漏洞中操纵某些缓存块上的一致性状态来改变缓存访问时间并非法传达秘密。我们的威胁模型假设木马和间谍可以利用显式共享的只读物理页面（例如共享库代码），或使用内存重复数据删除功能隐式强制创建共享物理页面。我们展示了一个模板，攻击者可以使用该模板通过操纵不同缓存中的一致性状态和数据放置的组合来构建隐蔽的定时通道。我们研究了几类缓存一致性协议，并观察到基于目录的协议和窥探协议都可能受到隐蔽的定时通道攻击。我们确定该漏洞的根本原因是在只读缓存一致性状态下缓存行存在访问延迟差异：独占和共享。为了防御，我们提出了一个稍微修改的缓存一致性方案，使末级缓存能够直接响应这些只读一致性状态下的读取数据请求，