A Practical Methodology for Measuring the Side-Channel Signal Available to the Attacker for Instruction-Level Events

TLDR

The paper introduces SAVAT, a metric for quantifying side‑channel signal from single‑instruction differences, and proposes a practical, user‑level methodology for measuring it. The authors measure SAVAT by recording electromagnetic emanations from 11 instructions on three laptop systems using only user‑level access and standard measurement tools. Experiments show that SAVAT is higher for off‑chip memory accesses than on‑chip instructions, that certain instructions like integer divide exhibit markedly higher SAVAT, and that the metric can identify the most vulnerable processor or program components.

Abstract

This paper presents a new metric, which we call Signal Available to Attacker (SAVAT), that measures the side channel signal created by a specific single-instruction difference in program execution, i.e. The amount of signal made available to a potential attacker who wishes to decide whether the program has executed instruction/event A or instruction/event B. We also devise a practical methodology for measuring SAVAT in real systems using only user-level access permissions and common measurement equipment. Finally, we perform a case study where we measure electromagnetic (EM) emanations SAVAT among 11 different instructions for three different laptop systems. Our findings from these experiments confirm key intuitive expectations, e.g. That SAVAT between on-chip instructions and off-chip memory accesses tends to be higher than between two on-chip instructions. However, we find that particular instructions, such as integer divide, have much higher SAVAT than other instructions in the same general category (integer arithmetic), and that last-level-cache hits and misses have similar (high) SAVAT. Overall, we confirm that our new metric and methodology can help discover the most vulnerable aspects of a processor architecture or a program, and thus inform decision-making about how to best manage the overall side channel vulnerability of a processor, a program, or a system.