Software security challenges in the era of modern hardware

Today's hardware cannot keep secrets. Indeed, the past two decades have seen the discovery of a slew of attacks where an adversary exploits hardware features to leak software's sensitive data. These attacks have shaken the foundations of computer security and caused a disruption in the software industry. Fortunately, there has been a saving grace, namely the widespread adoption of models that have enabled developers to build secure software while comprehensively preventing hardware vulnerabilities. This dissertation studies these prevailing models for building secure software and evaluates the extent to which they break down in the context of today's hardware. In the first part, we introduce Hertzbleed attacks, demonstrating that the principles underpinning constant-time programming are inadequate to guarantee constant-time execution of software. In the second part, we introduce interconnect side-channel attacks, demonstrating that the current implementation principles for resource partitioning are inadequate to guarantee software isolation. Both vulnerabilities are not mere extensions of existing ones but rather constitute entirely new attack vectors, which undermine established defenses. We present an in-depth examination of these new attacks and discuss their implications for secure software design.

Name thesis:degree_name

Ph.D.

Level thesis:degree_level

Dissertation

Discipline thesis:degree_discipline

Computer Science

Grantor

University of Illinois at Urbana-Champaign

Year dc:date

2023

Author dc:creator

• Paccagnella, Riccardo

Contributors dc:contributor

• Fletcher, Christopher
• Baumann, Andrew
• Torrellas, Josep
• Bailey, Michael
• Shacham, Hovav
• Yan, Mengjia

• Hardware Security
• Side-channel Attacks
• Constant-time Programming
• Resource Partitioning
• Computer Processors
• Frequency Scaling
• On-chip Interconnect

Statement dc:rights

• Copyright 2023 Riccardo Paccagnella

Language dc:language

en, eng

Handle dc:identifier

https://hdl.handle.net/2142/121442

OAI record oai:identifier

https://www.ideals.illinois.edu/oai-pmh?verb=GetRecord&metadataPrefix=etdms&identifier=oai%3Awww.ideals.illinois.edu%3A2142%2F121442