Jeu d'instructions x86 | EPFL Graph Search

Le jeu d'instructions du x86 a subi de nombreux changements au cours du temps. La plupart d'entre eux ne sont que des ajouts au jeu d'instructions initial afin d'apporter de nouvelles fonctionnalités. Jeu d'instructions sur les entiers Ceci est le jeu d'instructions complet pour les processeurs 8086-8088 et la plupart, si ce n'est toutes ces instructions sont accessibles en mode 32 bits. Elles opèrent alors sur les registres et valeurs (eax, ebx, etc.) en lieu et place de leur contrepartie en (ax, bx, etc.). Instructions originales des 8086/8088 Ajouts aux processeurs spécifiques Ajouts aux processeurs 80186/80188 BOUND, ENTER, INSB, INSW, LEAVE, OUTSB, OUTSW, POPA, PUSHA, PUSHW Ajouts au processeur 80286 ARPL, CLTS, LAR, LGDT, LIDT, LLDT, LMSW, LOADALL, LSL, LTR, SGDT, SIDT, SLDT, SMSW, STR, VERR, VERW Ajouts au processeur 80386 BSF, BSR, BT, BTC, BTR, BTS, CDQ, CMPSD, CWDE, INSD, IRETD, IRETDF, IRETF, JE

Automated Side-Channel Vulnerability Discovery and Hardening

Ali Galip Bayrak

In traditional cryptography, an attacker tries to infer a mathematical relationship between the inputs and outputs of a cryptosystem to recover secret information. With the advances in the theoretical basis of the cryptographic algorithms, this task became harder and attackers started to seek different approaches. A family of attacks known as side-channel attacks have focused on using information leaked through the underlying device when the cryptographic algorithm is running. For instance, a power analysis attack can exploit the relationship between the inputs of a cryptosystem and the underlying device’s power consumption while performing cryptographic operations on these inputs. Such attacks have shown to be so successful and efficient in practice that prudent designers now insert countermeasures against these attacks to their hardware and software systems. However, the insertion process is challenging to a non-expert in cryptography due to several factors including unnatural structure of the countermeasures (e.g., obfuscating the implementation), use of non-standard elements in the design (e.g., using non-CMOS logic styles), conflict with standard design parameters and the optimization processes of design tools (e.g., adding dummy operations, which are normally eliminated by the design tools to increase performance), etc. To facilitate a reliably-secure design process, this thesis proposes automated methodologies which analyze a given hardware or software cryptosystem and insert appropriate side-channel countermeasures. We first propose one type of hardware countermeasure and show how it can easily be integrated into the standard electronic design automation flow to protect high-level hardware implementations. The countermeasure is based on adding random jitter to the clocks of sequential circuit elements, and incurs a modest area and energy overhead. Next, we propose a hardware extension unit, an instruction shuffler, to existing processors. The unit is very lightweight and does not require any architectural changes, and hence can be used with any processor, increasing the side-channel resistance of the overall system. We then present a compiler, which can easily be combined with the off-the-shelf compilers, to automatically apply countermeasures on given software implementations. We show that the compiler can produce protected implementations that are as efficient as their manually optimized counterparts, eliminating the need for designer expertise and time. Finally, we present an automated security verification methodology, which checks certain properties to detect potential vulnerabilities in a (manually or automatically) protected implementation. Our experiments show that we can successfully detect common security problems in a flawed implementation of a countermeasure within a reasonable amount of time.

EPFL2014

An Architecture-Independent Instruction Shuffler to Protect against Side-Channel Attacks

Ali Galip Bayrak, Paolo Ienne, Nikola Velickovic

Embedded cryptographic systems, such as smart cards, require secure implementations that are robust to a variety of low-level attacks. Side-Channel Attacks (SCA) exploit the information such as power consumption, electromagnetic radiation and acoustic leaking through the device to uncover the secret information. Attackers can mount successful attacks with very modest resources in a short time period. Therefore, many methods have been proposed to increase the security against SCA. Randomizing the execution order of the instructions that are independent, i.e., random shuffling, is one of the most popular among them. Implementing instruction shuffling in software is either implementation specific or has a significant performance or code size overhead. To overcome these problems, we propose in this work a generic custom hardware unit to implement random instruction shuffling as an extension to existing processors. The unit operates between the CPU and the instruction cache (or memory, if no cache exists), without any modification to these components. Both true and pseudo random number generators are used to dynamically and locally provide the shuffling sequence. The unit is mainly designed for in-order processors, since the embedded devices subject to these kind of attacks use simple in-order processors. More advanced processors (e.g., superscalar, VLIW or EPIC processors) are already more resistant to these attacks because of their built-in ILP and wide word size. Our experiments on two different soft in-order processor cores, i.e., OpenRISC and MicroBlaze, implemented on FPGA show that the proposed unit could increase the security drastically with very modest resource overhead. With around 2% area, 1.5% power and no performance overhead, the shuffler increases the effort to mount a successful power analysis attack on AES software implementation over 360 times.

2012

Easy and Accurate Hardware-based Program Performance Monitoring

Andrzej Pawel Nowak

The performance monitoring of computer systems is a complex affair, made even more challenging by the increasing gap between hardware and software. Methods that collect and feed data to performance analysis can usually be classified into one of two groups. Methods in the first group (e.g., software instrumentation), can be accurate but have unacceptable overheads and offer no insight into the interaction of the software and the hardware. Methods in the second group (e.g., hardware supported) run in real time and connect code to the response in the architecture, at a considerable decrease in accuracy, with a high degree of specificity to the hardware and therefore with limited actionable information made available. In this work, we focus on the latter group - the collection and analysis of raw performance data sourced from hardware Performance Monitoring Units, built into the majority of processors. The periodic collection of samples (Event Based Sampling), containing code locations, for instance, can be triggered on events such as retired instructions or cache misses. We quantify accuracy improvements to existing methods, propose a better performing method of performance data collection and a new architecture-agnostic method of performance data analysis. In our experiments, we analyze compiled, large-scale production workloads, industry standard benchmarks, and micro-benchmarks reproducing specific architectural behaviors. First, we focus on performance data collection methods and their accuracy, when establishing instruction retirement rates. These vary from least to most advanced and we examine the low level factors influencing accuracy. In particular, we employ a method based on Last Branch Records, a hardware facility present on some Intel architectures, which allows for the sampling of short records of last taken branches leading up to the sample. We compare the most commonly used method, its improved derivatives and the Last Branch Record based method. With respect to the first method, we observe accuracy improvements of up to 18x on synthetic benchmarks and 15x on real applications. Second, to further improve accuracy, we propose a new collection method named Hybrid Basic Block Profiling, fusing those based on Last Branch Records and the widely used Event Based Sampling. We apply simple machine learning techniques to determine the operating criteria. As a demonstration of capability, our method and a profiling tool are used to generate Instruction Mixes, which traditionally require good quality data at the most detailed level of granularity - basic blocks. Compared to software instrumentation, we observe an improvement in runtime of up to 76x, while keeping instruction attribution errors at 2.1% on average. In our third contribution we describe an architecture-agnostic performance analysis methodology called Hierarchical Cycle Accounting. The user is presented with a navigable hierarchy of microarchitectural issues, expressed in a metric that is universal and simple to compare - core cycles. We develop a reference implementation for the Intel Ivy Bridge microarchitecture and provide pointers for implementations on other processor architectures. Our approach and tool are successfully used by non-experts to improve and vectorize complex scientific code. Experts benefit as well - by being able to pinpoint software issues undetected by other methods, and identifying a bug in a family of Intel processors.

EPFL2017