Thwarting Cache Side-Channel Attacks Through Dynamic Software Diversity

TLDR

Existing software diversity techniques transform each program trace identically. We explore software diversity as a defense against side‑channel attacks by dynamically and systematically randomizing the control flow of programs. The method generates numerous diversified replicas of program fragments, each with distinct implementations yet equivalent semantics, and randomly switches between them at runtime to obscure control flow and thwart cache‑based side‑channel attacks. The approach probabilistically protects against online and offline side‑channel attacks, requires no manual effort or hardware changes, incurs reasonable performance overhead, and significantly reduces side‑channel information leakage.

Abstract

We explore software diversity as a defense against side-channel attacks by dynamically and systematically random- izing the control flow of programs. Existing software diversity techniques transform each program trace identically. Our di- versity based technique instead transforms programs to make each program trace unique. This approach offers probabilistic protection against both online and off-line side-channel attacks. In particular, we create a large number of unique program execution paths by automatically generating diversified replicas for parts of an input program. Replicas derived from the same original program fragment have different implementations, but perform semantically equivalent computations. At runtime we then randomly and frequently switch between these replicas. We evaluate how well our approach thwarts cache-based side- channel attacks, in which an attacker strives to recover cryp- tographic keys by analyzing side-effects of program execution. Our method requires no manual effort or hardware changes, has a reasonable performance impact, and reduces side-channel information leakage significantly.