Time Protection: the Missing OS Abstraction Qian Ge Yuval Yarom UNSW Australia and Data61 CSIRO The University of Adelaide and Data61 CSIRO [email protected] [email protected] Tom Chothia Gernot Heiser University of Birmingham UNSW Australia and Data61 CSIRO [email protected] [email protected] ABSTRACT use of the hardware, remain a fundamental OS security chal- Timing channels enable data leakage that threatens the se- lenge that has eluded a comprehensive solution to date. Its curity of computer systems, from cloud platforms to smart- importance is highlighted by recent attacks, including the phones and browsers executing untrusted third-party code. extraction of encryption keys across cores [Irazoqui et al. Preventing unauthorised information flow is a core duty 2015; Liu et al. 2015] through side channels, i.e. without the of the operating system, however, present OSes are unable cooperation of the key owner. to prevent timing channels. We argue that OSes must pro- In contrast, covert channels depend on insider help and are vide time protection in addition to the established memory traditionally considered a less significant threat. However, in protection. We examine the requirements of time protec- the recent Spectre attack [Kocher et al. 2019], an adversary tion, present a design and its implementation in the seL4 uses a covert communication channel from speculatively microkernel, and evaluate its efficacy as well as performance executed gadgets to leak information. This demonstrates overhead on Arm and x86 processors. that covert channels pose a real security risk even where no side-channel attack is known. Furthermore, covert chan- nel mechanisms bear the risk of being exploitable as a side 1 INTRODUCTION channel by an ingenious attacker. One of the oldest problems in operating systems (OS) re- We argue that it is time to take temporal isolation seri- search is how to confine programs so they do not leak infor- ously, and make time protection a primary OS duty, just as the mation [Lampson 1973]. To achieve confinement, the operat- established memory protection.1 Such a design must elim- ing system needs to control all of the means of communica- inate, as far as possible, the sharing of hardware resources tion that the program can use. For that purpose, programs are that is the underlying cause of timing channels. The ultimate typically grouped into security domains, with the operating aim should be to obtain temporal isolation guarantees com- system exerting its control on cross-domain communication. parable to the spatial isolation proofs of seL4, but for now we Programs, however, can bypass OS protection by sending focus on a design that is suitable for a verifiable OS kernel, information over channels that are not intended for com- i.e. minimal, general and policy-free. munication. Historically, such covert channels were explored Specifically, we make the following contributions: within the context of military multi-level-secure systems [De- • partment of Defence 1986]. Cloud computing, smartphone We define the requirements for providing time protec- apps and server-provided JavaScript executed in browsers tion, enabling confinement in the presence of microar- mean that we now routinely share computing platforms with chitectural timing channels (Section 3.2); arXiv:1810.05345v2 [cs.OS] 15 Oct 2018 • untrusted, potentially malicious, third-party code. we introduce a policy-free kernel clone operation that OSes have traditionally enforced security through memory allows almost perfect partitioning of a system, i.e. al- protection, i.e. spatial isolation of security domains. Recent ad- most completely removing sharing between security vances include formal proof of spatial security enforcement domains (Section 3.3); • by the seL4 microkernel [Klein et al. 2014], including proof we present an implementation in seL4 (Section 4); • of the absence of covert storage channels [Murray et al. 2013], we show that our implementation of time protection i.e. channels based on storing information that can be later is effective, transparently removing timing channels, loaded [Department of Defence 1986; Schaefer et al. 1977]. within limitations of present hardware (Section 5.3); Spatial isolation can thus be considered a solved problem. The same cannot be said about temporal isolation. Timing 1Note that we use the term “OS” in a generic sense, referring to the most channels, and in particular microarchitectural channels [Ge privileged software level that is responsible for security enforcement. This et al. 2018b], which exploit timing variations due to shared could refer to a hypervisor or the OS of a non-virtualised system. 1 • we show that the overhead imposed by these mecha- state machines, can be used as well. Fundamentally, the cache nisms is low (Section 5.4). channel works by the sender (intentionally or incidentally) modulating its footprint in the cache through its execution, 2 BACKGROUND and the receiver probing this footprint by systematically 2.1 Covert channels and side channels touching cache lines and measuring memory latency by ob- serving its own execution speed. Low latency means that a A covert channel is an information flow that uses a mecha- line is still in the cache from an earlier access, while high nism not intended for information transfer [Lampson 1973]. latency means that the corresponding line has been replaced Covert channels therefore may violate the system’s security by the sender competing for cache space. Such attacks are policy, allowing communication between security domains possible where the resource is shared concurrently (cores that should be isolated. Note that our use of the term (se- or hardware threads sharing a cache) or time-multiplexed curity) domain is more general than the standard OS term (time-sharing a core). protection domain (a specific set of access rights). A security Side-channel attacks are similar, except that the sender domain consists of one or more protection domains. does not actively cooperate, but accesses cache lines accord- There is a traditional distinction between storage and tim- ing to its computational needs. Thus, the attacker must syn- ing channels, where exploitation of the latter requires the chronise its attack with the victim’s execution and eliminate communicating domains to have a common notion of time any noise with more advanced techniques. Side-channel at- [Department of Defence 1986; Schaefer et al. 1977; Wray tacks have been demonstrated against the L1-D [Hu 1992] 1991]. In principle, it is possible to completely eliminate stor- and L1-I caches [Acıiçmez 2007], the last-level cache (LLC) age channels, as was done in the information-flow proof of 2 [Irazoqui et al. 2015; Liu et al. 2015], the TLB [Gras et al. seL4 [Murray et al. 2013]. 2018; Hund et al. 2013] and the BP [Acıiçmez et al. 2007]. Despite recent progress on proving upper bounds for the Interconnects of limited bandwidth can also be used for cache side channels of cryptographic implementations [Doy- covert channels: the sender encodes information into its chev et al. 2013; Köpf et al. 2012], proofs of complete elimi- bandwidth consumption, and the receiver senses the avail- nation of timing channels in a non-trivial system are beyond able bandwidth. So far, interconnects can only be exploited current formal approaches, and measurements are essential as a covert channel while the sender and receiver execute for their analysis. concurrently (on different cores). Also, if only bandwidth can In a narrow sense, a covert channel requires collusion be- be used for signalling, side channels are probably impossible tween the domains, one acting as a sender and the other as to implement, none have been demonstrated to date. a receiver. Typical cases of senders are Trojans, i.e. trusted code that operates maliciously, or untrusted code that is be- 2.3 Countermeasures ing confined [Lampson 1973]. Due to the collusion, a covert channel represents a worst case for bandwidth of a channel. The countermeasures must prevent interference resulting In contrast, a side channel has an unwitting sender, called from resource competition while processing secret informa- the victim, who, through its normal operation, is leaking tion. For bandwidth-limited interconnects, this would require information to an attacker acting as the receiver. An im- time-multiplexing the interconnect or using some hardware 3 portant example is a victim executing in a virtual machine mechanism to partition available bandwidth. (VM) on a public cloud, who is being attacked by a malicious The OS can prevent interference on stateful resources by 4 co-resident VM [İnci et al. 2016; Yarom and Falkner 2014]. flushing between accesses or by partitioning. Flushing is conceptually simple (although can be diffi- 2.2 Microarchitectural channels cult in practice, as we will discuss in Section 4.3). It is only applicable for time-multiplexed hardware; flushing cannot Microarchitectural timing channels result from competition prevent cross-core attacks through a shared cache. Flushing for capacity- or bandwidth-limited hardware features that can also be very costly in the case of large caches (LLC), as are functionally transparent to software [Ge et al. 2018b]. we demonstrate in Section 5.2. Capacity-limited resources include the data and instruc- tion caches, these can be used to establish high-bandwidth 3Intel recently introduced memory bandwidth allocation (MBA) technology, channels [Hu 1992; Liu et al. 2015; Maurice et al. 2017]. How- which imposes approximate limits on the memory bandwidth available to a ever, other microarchitectural state, such as the translation core [Intel Corporation 2016]. This is a step towards bandwidth partitioning, lookasid buffer (TLB), branch predictor (BP) or prefetcher but the approximate enforcement is not sufficient for preventing covert channels. 2Specifically, the proof shows that no machine state that is touched by 4In principle, it is also possible to prevent timing channels by denying the kernel can be used as a storage channel, it does not exclude channels attackers access to real time, but in practice this is infeasible except in through state of which the kernel is unaware.