Poster: Symbolic path cost analysis for side-channel detection

Tegan Brennan, Seemanta Saha, Tevfik Bultan

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

7 Scopus citations

Abstract

We present a static, scalable analysis technique for detecting side channels in software systems. Our method is motivated by the observation that a sizable class of side-channel vulnerabilities occur when the value of private data results in multiple distinct control flow paths with differentiable observables. Given a set of secret variables, a type of side channel, and a program, our goal is to detect the set of branch conditions responsible for potential side channels of the given type in the program, and generate a pair of witness paths in the control flow graph for the detected side channel. Our technique achieves this by analyzing the control flow graph of the program with respect to a cost model (such as time or memory usage), and identifies if a change in the secret value can cause a detectable change in the observed cost of the program behavior. It also generates a pair of witness paths in the control flow graph, differing only on the branch conditions influenced by the secret, and whose observable output under the given side channel differs by more than some user defined threshold. We implemented our approach in a prototype tool, CoCo-Channel (Compositional Constraint-based side Channel analyzer), for analyzing Java programs.

Original languageEnglish
Title of host publicationProceedings - International Conference on Software Engineering
Pages424-425
Number of pages2
ISBN (Electronic)9781450356633
DOIs
StatePublished - 27 May 2018
Event40th ACM/IEEE International Conference on Software Engineering, ICSE 2018 - Gothenburg, Sweden
Duration: 27 May 20183 Jun 2018

Publication series

NameProceedings - International Conference on Software Engineering
ISSN (Print)0270-5257

Conference

Conference40th ACM/IEEE International Conference on Software Engineering, ICSE 2018
Country/TerritorySweden
CityGothenburg
Period27/05/183/06/18

Fingerprint

Dive into the research topics of 'Poster: Symbolic path cost analysis for side-channel detection'. Together they form a unique fingerprint.

Cite this