Code integrity verification using cache memory monitoring

ABSTRACT

This paper addresses the challenges of building a secure software system to prevent Man-at-the-End attacks. Ensuring the security of systems is challenging due to unfavorable constraints faced by the end-point host system. Constraints such as hostile environments leave the host system at the peril of would-be attackers. In this paper, we verify program integrity through L3 cache by monitoring the security-sensitive code points and verify them in memory. This paper uses a cache-based monitoring program to verify code integrity. In particular, we show that side-channel information can be used to encode the invariant of the program execution state. These invariants can be periodically and externally monitored as a proxy for application integrity. This monitoring system uses a sliding window scheme that can detect the violation of these invariant with high reliability. The proposed solution is transparent to the attacker and utilizes a side-channel technique (Flush + Reload) along with a sliding window scheme to monitor security-sensitive code and detect MATE attacks to prevent malicious manipulation of software.

KEYWORDS:

• Side-channel attack
• flush + Reload
• last-level cache
• cache memory

Acknowledgments

Open Access funding provided by the Qatar National Library.

This work is supported by the Ministry of Electronics and Information Technology (MeitY), Govt. of India and the Netherlands Organization for Scientific research (NWO), Netherlands.