Eliminating Cache-Based Timing Attacks with Instruction-Based Scheduling

Information flow control allows untrusted code to access sensitive andtrustworthy information without leaking this information. However, the presenceof covert channels subverts this security mechanism, allowing processes to communicate information in violation of IFC policies. In this paper, we show thatconcurrent deterministic IFC systems that use time-based scheduling are vulnerable to a cache-based internal timing channel. We demonstrate this vulnerabilitywith a concrete attack on Hails, one particular IFC web framework. To eliminatethis internal timing channel, we implement instruction-based scheduling, a newkind of scheduler that is indifferent to timing perturbations from underlying hardware components, such as the cache, TLB, and CPU buses. We show this scheduler is secure against cache-based internal timing attacks for applications using asingle CPU. To show the feasibility of instruction-based scheduling, we have implemented a version of Hails that uses the CPU retired-instruction counters available on commodity Intel and AMD hardware. We show that instruction-basedscheduling does not impose significant performance penalties. Additionally, weformally prove that our modifications to Hails’ underlying IFC system preservenon-interference in the presence of caches