SC-K9: A Self-synchronizing Framework to Counter Micro-architectural Side Channels

Abstract

Side channels within the processor mi-croarchitecture are notorious for their ability to leak information without leaving any physical traces for forensic examination. Most prior detection frame-works typically choose to continuously sample a select subset of hardware events without attempting to understand the mechanics behind the side channel activity. In this work, we propose SC-K9, a novel framework that synchronizes its sampling frequency with that of the adversary, thereby improving the detection accuracy even when the frequency of attack operations vary with specific implementations. We then deploy a hardware-based deception strategy to trick the adversary and annul its observations from the side channel activities. We illustrate our design and demonstrate its effectiveness in identifying some of the potent side channels exposed by recent speculative execution attacks. Our experimental results show that SC-K9 can effectively spot adversaries at different operational modes, and incurs very low rate of false alarms among the benign workloads.