Eliminating cache-based timing attacks with instruction-based scheduling: Extended version. http: //www.cse.chalmers.se/~buiras/esorics2013_extended.pdf

Abstract. Information flow control allows untrusted code to access sensitive and trustworthy information without leaking this information. However, the presence of covert channels subverts this security mechanism, allowing processes to com-municate information in violation of IFC policies. In this paper, we show that concurrent deterministic IFC systems that use time-based scheduling are vulner-able to a cache-based internal timing channel. We demonstrate this vulnerability with a concrete attack on Hails, one particular IFC web framework. To eliminate this internal timing channel, we implement instruction-based scheduling, a new kind of scheduler that is indifferent to timing perturbations from underlying hard-ware components, such as the cache, TLB, and CPU buses. We show this sched-uler is secure against cache-based internal timing attacks for applications using a single CPU. To show the feasibility of instruction-based scheduling, we have im-plemented a version of Hails that uses the CPU retired-instruction counters avail-able on commodity Intel and AMD hardware. We show that instruction-based scheduling does not impose significant performance penalties. Additionally, we formally prove that our modifications to Hails ’ underlying IFC system preserve non-interference in the presence of caches.