Rochester Joint Chapter of the IEEE Computer and Computational Intelligence Societies

Rochester, New York

Date: Friday, November 9, 2018
Time: 11:00 a.m. to 12:30 p.m. -- 11:00am: Presentation, 12:00pm: Pizza/Networking
Location: RIT Campus, Golisano Hall - Bldg 70, Room 3560
Computer Society announcements and venue information:
      https://ewh.ieee.org/r1/rochester/computer
Cost: Free. Open to IEEE members and non-members.
Note: This event is co-sponsored with RIT's GCCIS PhD Colloquium
IEEE Event Entry: https://events.vtools.ieee.org/m/176639

Abstract

It is found that existing and powerful cache side-channel attacks on Intel architectures, including Prime+Probe, are ineffective on mobile and Internet-of-things (IoT) devices powered by ARM architectures. The trust in ARM's hardware-isolated execution environments, namely TrustZone, was also reinforced by these findings. However, those discoveries do not rule out novel and more sophisticated cache side-channel attacks that leverage overlooked hardware features. In this talk, I will present a novel Prime+Count attack that can be used to build reliable covert channels between the normal and secure world of TrustZone, which breaks one of its fundamental security guarantees.

On the other hand, protections that can defeat previous cache side-channel attacks on Intel architectures are not necessarily effective in mitigating novel cache attacks on ARM platforms. Such solutions attempt to mitigate attacks by explicitly or implicitly creating a private space, in which constant-time access to sensitive data is assured. However, some of the attempts utilize hardware features available only on certain Intel processors. In this talk, I will also discuss a defense against cache side-channel attacks that can protect against both dedicated cache (L1) and shared cache (L2) attacks on mobile and IoT devices.

Speaker's Biography

Ziming Zhao is an assistant professor at the computing security department of RIT. He received the PhD degree in computer science from Arizona State University in 2014. His research foci include system and software security, network security, usable and user-centric security, cybercrime and threat intelligence analytics. His research has led to 45+ publications in security conferences and journals, including IEEE S&P, ACM CCS, USENIX Security, NDSS, ACSAC, TISSEC, etc. He won a best paper award in ACM CODASPY 2014 and IEEE ITU Kaleidoscope 2016. He directs the CyberspACe securiTy and forensIcs lab (CactiLab, https://cactilab.info/). He is looking for motivated students to work on security. Shoot him an email if you are interested.