Clockwork: Tracking Remote Timing Attacks

Bastys, Iulia, 1986 (författare): Chalmers tekniska högskola,Chalmers University of Technology

Balliu, Musard, 1985 (författare): KTH,Teoretisk datalogi, TCS,Kungliga Tekniska Högskolan (KTH),Royal Institute of Technology (KTH)

Rezk, Tamara, 1978 (författare): Institut National de Recherche en Informatique et en Automatique (INRIA),INRIA Sophia-Antipolis

Sabelfeld, Andrei, 1974 (författare): Chalmers tekniska högskola,Chalmers University of Technology

(creator_code:org_t)

IEEE, 2020
2020
Engelska.
Ingår i: Proceedings - IEEE Computer Security Foundations Symposium. - : IEEE. - 1940-1434. ; 2020-June, s. 350-365

Relaterad länk:: https://www.ieee-sec...; visa fler...; https://kth.diva-por... (primary) (Raw object); https://doi.org/10.1...; https://research.cha...; https://research.cha...; https://urn.kb.se/re...; visa färre...

Abstract Ämnesord

Stäng

Timing leaks have been a major concern for the security community. A common approach is to prevent secrets from affecting the execution time, thus achieving security with respect to a strong, local attacker who can measure the timing of program runs. However, this approach becomes restrictive as soon as programs branch on a secret. This paper focuses on timing leaks under remote execution. A key difference is that the remote attacker does not have a reference point of when a program run has started or finished, which significantly restricts attacker capabilities. We propose an extensional security characterization that captures the essence of remote timing attacks. We identify patterns of combining clock access, secret branching, and output in a way that leads to timing leaks. Based on these patterns, we design Clockwork, a monitor that rules out remote timing leaks. We implement the approach for JavaScript, leveraging JSFlow, a state-of-the-art information flow tracker. We demonstrate the feasibility of the approach on case studies with IFTTT, a popular IoT app platform, and VJSC, an advanced JavaScript library for e-voting.

NATURVETENSKAP -- Data- och informationsvetenskap -- Datorteknik (hsv//swe)
NATURAL SCIENCES -- Computer and Information Sciences -- Computer Engineering (hsv//eng)
NATURVETENSKAP -- Data- och informationsvetenskap -- Datavetenskap (hsv//swe)
NATURAL SCIENCES -- Computer and Information Sciences -- Computer Sciences (hsv//eng)
TEKNIK OCH TEKNOLOGIER -- Elektroteknik och elektronik -- Datorsystem (hsv//swe)
ENGINEERING AND TECHNOLOGY -- Electrical Engineering, Electronic Engineering, Information Engineering -- Computer Systems (hsv//eng)

Av författaren/redakt...: Bastys, Iulia, 1 ...; Balliu, Musard, ...; Rezk, Tamara, 19 ...; Sabelfeld, Andre ...

Om ämnet

TEKNIK OCH TEKNOLOGIER: TEKNIK OCH TEKNO ...; och Elektroteknik oc ...; och Datorsystem

Kungliga biblioteket hanterar dina personuppgifter i enlighet med EU:s dataskyddsförordning (2018), GDPR. Läs mer om hur det funkar här.
Så här hanterar KB dina uppgifter vid användning av denna tjänst.