Strong and Efficient Cache Side-Channel Protection...
summary
Cloak uses Intel TSX to pin sensitive code and data into L1/L3 by preloading and executing every cache line (compiler-inserted return opcodes) and a C++ container that places read/write buffers into reserved cache sets, aiming to stop prime+probe/flush+reload. Claims full protection against known cache attacks with low overhead: AES shows near-zero overhead, gap tables faster, while a 500 KB decision-forest incurs about 248% overhead. Works inside Intel SGX and relies on TSX transactions to abort on eviction.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 0:46Motivation
- 2:37Background
- 4:09Example
- 6:44Typical countermeasures
- 8:11Initial observation
- 9:09Entities
- 14:10Summary
- 15:55Trick
- 16:26Advanced Reading Strategy
- 17:36ATT Tables
- 18:40Attack
- 20:04Algorithm
- 21:39Service Contract
- 24:35Questions
related talks
24mShielding Software From Privileged Side-Channel Attacks
27mTranslation Leak-aside Buffer: Defeating Cache Side-channel Protections
01h 01mTutorial: Side-Channel Attacks and Transient Execution Vulnerab...
15mI Know What You Said: Unveiling Hardware Cache Side-Channels in Local Large
15mSpecSafe: Detecting Cache Side Channels in a Speculative World
13mExposing Cache Timing Side-Channel Leaks through Out-of-Order Symbolic Execution
30mProactive Software Defense against Side Channel Attacks
35mPage Cache Attacks: Microarchitectural Attacks on Flawless Hardware