Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Architecture > Security > Flashcards

Security Flashcards

1
Q

What are exception levels in the ARMv8-A execution model

A

The levels determine the level of execution privilege, e.g. “user mode” and “privileged mode”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are trusted execution environments?

A

Split the architecture into a “normal world” and a “secure world”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What is the role of “secure world”?

A

Has its own software

Deals with more sensitive operations (encryption, etc.)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What does the “secure world” in ARMv8-A consist of?

A

Has 3 exception levels:

EL0: For applications

EL1: For trusted OS

EL3: Secure monitor, this secure monitor manages both the normal- and the secure-world

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does the “normal world” in ARMv8-A consist of?

A

EL0: Run applications

EL1: OS kernel (Guest OSes), e.g. Linux or Windows runnin in non-secure EL1. When running under a hypervisor, we can switch between the OSes and run the OS kernels either as host or guest.

EL2: Hypervisor, when present and enabled, switches operation between multiple guest OSes

EL3: Low-level firmware (Secure monitor)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What does the Secure monitor in EL3 do?

A

Deals with the transition from normal- to secure-world

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What are the security states?

A

Normal world: Non-secure state
Secure world: Run specific security features

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is Secure firmware in the secure world?

A

To ensure a secure system, the secure firmware is the first thing that is booted, and initializing everything, before handing it over to the normal, non-secure world.

It provides services such as platform initialization, installation of Trusted OS and routing of Secure monitor calls

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What does the Trusted OS do? (3)

A

Partitions between different functionalities we want to have within the secure world, that are not supposed to interfene with each other or leak information to each other.

Provides secure services to the normal world.

Provides a runtime environment for executing Secure or trusted applications

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What exception level does the trusted OS run at?

A

EL2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What exception level does secure firmware run at?

A

Runs at EL3 or EL1

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

In the secure, and non-secure world, what is the component with the highest privilege?

A

The Monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does the monitor do in the secure- and non-secure world?

A

Handles communication and switching between the secure kernels and non-secure kernels

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

How does a non-secure application communicate with the monitor?

A

Not directly, through the privileged modes escalation that is the non-secure kernel

app -> kernel -> monitor

Uses fixed entry points to the monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

How does caches and MMU (memory management unit) separate between the secure- and non-secure world?

A

Have a security-bit (NS/S)
This separates the hardware resources, such that you cant access secure resources from the non-secure world.

The AXI protocol (from interconnects) has a AxPROT[1] signal that indicates if an access is secure or non-secure. When a message is sent on the interconnect, we have this additional wiring that tells if the message is sent securely or not.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What can happen if secure booting does not happen correctly?

A

Can get a compromised system if the secure world is not enabled correctly or not at all

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Why is the design of a boot sequence important?

A

It is a fundamental part of creating a secure system.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are some normal boot actions when initializing a secure OS? (4)

A

All these actions are done in secure-mode because we have access to all the hardware.

Generating page tables

Switch on the MMU (if design uses caches or memory protection)

Switch on the stack

Set up run time environment and program stacks for each processor mode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What happens when we initialize the secure monitor, during the boot sequence?

A

The secure monitor is the component with highest privileges.

Allocates scratch workspace

Set up secure monitor stack pointer and initialize its state block

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the 4 steps in a boot sequence?

A

1: Initialize secure OS

2: Initialize secure monitor

3: Program the partition checker to allocate physical memory available to the non-secure OS

4: Yield control to the Non-secure OS, the non-secure OS boots after this - i.e. the windows or linux system will start booting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Who is responsible for switching between secure and non-secure world?

A

The secure monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What it the SMC instruction?

A

Called when we want to switch between worlds.

Requires privileged level.

A user application is required to execute a supervisor call (SVC) instruction and let the supervisor call handler perform the SMC and connect to the secure monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the secure monitor mode?

A

Highest privilege level

Is always secure regardless of the state of the NS bit. There is a NS bit in the processor that tells if we are currently in the secure or non-secure mode.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is the Secure Monitor itself?

A

Code that runs in Secure Monitor mode (EL3)

It processes the switches between non-secure and secure world

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What does the overall security of the software rely on?

A

The security of the Secure monitor code, along with the secure boot code.

If there is a bug there, we can gain access to everything, because the NS bit does not mean anything here.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the secure world used for? (4)

A

Secure boot

Accessing hardware features
- user applications must go through the secure world to access these
- crypto engine
- credential storage(key store)
- true random number generator)

Digital rights management

Protecting/monitoring the normal world
- real time kernel protection
- periodic kernel measurement (go in and check if any modifications has been done to the kernel code)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is TrustZone in ARM microcontrollers?

A

The separation between non-secure and secure state

Non secure: Rich OS (linux)

Secure: Secure app/libs, -OS and -monitor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the SAU (security attribution unit) in ARM micro controllers?

A

Separates the secure and non-secure world

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Describe the flow when a request comes from the CPU to the SAU

A

Request from CPU -> SAU

The SAU either accesses the non-secure MPU or secure MPU (memory protection unit).
Which MPU is accessed depends on the NS bit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What happens if you do a NS access to a secure address?

A

Memory fault

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What are a structural difference between a secure- and non-secure MPU?

A

The NON-secure has some regions (memory addresses) that cannot be accessed, whereas these would be accessible in the secure state.

30
Q

What are a difference between code execution in a non-secure and a secure region?

A

Code executed from a non-secure region can only access non-secure regions, whereas code executed from a secure region can access memory in both regions.

31
Q

Give an example of the secure state using function calls to access the non-secure state?

A

Can use function calls to access resources/devices in the non-secure state, e.g. I/O driver

32
Q

Why is the switching between secure and non-secure state an important matter of itself?

A

Because this too must be done in a secure manner.

33
Q

How can the transition from secure to non-secure state be done?

A

By calling a non-secure function (BLXNS): The secure world is aware of what functions exist in the non-secure world. Can simply just access these.

Returning from an entry function (BXNS): The non-secure world has called into the secure world, and finished what it needed to do there, it can return from this call. In this case too, the secure state need to know where to return to.

34
Q

How can the transition from non-secure to secure state be done?

A

A branch to a secure gateway (BL to SG): Not allowed to call/jump into whatever region in the secure region we want. To limit this, a specific instruction is used. This instruction jumps into known places in the secure world.

Branch to the reserved value FNC_RETURN (BX to FNC):
The secure state has called a function in the non-secure state, when this function completes it wants to return to the secure state. The non-secure state executes a function return. The function return does not have a specific address, but this address is set when the insecure function is called. Store the return address in the secure world and this can’t be modified by the insecure state. This allows the secure world to have the full control of where it again will be entered, when the non-secure function returns.

35
Q

What is a secure gateway?

A

A occurrence of the secure gateway instruction (SG) in a special type of secure region, named non-secure callable region (NSC)

36
Q

What is SG?

A

Secure gateway instruction

37
Q

What is NSC?

A

A special type of secure region, named a non-secure callable region.

In the secure boot when address spaces are set up, one of these are the NSC.

In this region, the only thing we have is the secure gateway (SG) instructions, and the address into the secure world.

38
Q

What does FNC_RETURN do?

A

Causes the HW to switch to secure state., read an address from the top of the secure stack, and branch to that address

39
Q

Study the state diagrams in the Secure video 1 at 24:28

A
40
Q

How can the secure world be used in SW development?

A

Import the “Secure gateway import library”, this contains the addresses of the secure gateways.
- Defines symbols for all the secure gateways

A toolchain must support generating a secure gateway veneer for each entry function

41
Q

What is the memory layout of the Non-secure callable region (NSC)

A

It contains a vector of secure gateway veneers.

The veneers contain the secure gateway instruction that can call specific entry functions in the secure regions.

Each gateway has a specific address to call into specific entry functions.

42
Q

What is the memory layout of the Secure region?

A

Entry functions
Secure code (internal functions)
Secure data (Stack, heap, global data)

43
Q

What is the MPU?

A

Memory Protection Unit

A simpler version of the MMU (Memory management unit).

MPU handles more corse grained partitioning, and MMU enables virtual memory and page tables.

MPUs are normal in micro controllers where a complex OS and memory management are not needed, though the properties of the MPU and MMU are similar.

44
Q

Describe the ARM MPU

A

Programmable unit

Allows privileged software to define memory access permissions for different memory regions.

Monitors transactions, including fetches and data accesses from the processor. Checks if an access is allowed or not.

45
Q

Describe the ARMv8-M MPU

A

Supports a configurable number of programmable regions. Typical implementation supports 0-8 regions per security state.

Smallest size programmed for an MPU region is 32 bytes. Maximum is 4GiB, must be a multiple of 32 bytes.

All regions must begin on a 32-byte aligned address.

Regions have independent rd/wr access permissions for privileged and unprivileged code.

46
Q

What does the ARMv8-M Security Extensions allow?

A

To have one set of MPU configuration registers for the secure world and another set for the non-secure world.

47
Q

What are the 2 types of memory that can be specified?

A

Normal memory
Device memory

48
Q

What is normal memory used for?

A

Instructions and data

49
Q

What is device memory used for?

A

Used to access peripheral registers and Memory Mapped I/O (MMIO)

50
Q

What are some attributes of normal memory?

A

Cacheability

Shareability (for data and instructions)

eXecute Never (XN)

51
Q

Describe Shareability

A

Shareability (for data and instructions):
- Non-shareable: no one else uses it, memory accesses don’t need to be synchronised with other processors.

Relates to interconnects, and having clusters of CPUs
- Inner shareable: Data/instructions are shared within the cluster. The shareability domain can contain multiple masters, but not necessarily all the agents in a system.

  • Outer shareable: Share between multiple clusters.

This knowledge helps with optimisation done for cache coherency, for example. If data is non-shareable, we don’t need to worry about coherency, and if it is inner we only need to have coherency within a cluster. An operation that affects an outer shareable domain also implicitly affects all inner shareable domains inside it.

52
Q

Describe cacheability

A

Cacheability:
- Cache policy (write-through, write-back)
- Allocation (if miss, should allocate a new line?)
- Transient Hint (Hint regarding temporal locality)

53
Q

Describe eXecute Never (XN)

A

Separates between instructions and data. Marks data non-executable.

Make sure an attacker cannot write code into data memory, which are actual instructions. And then make the CPU jump to this data which would make it execute it.

54
Q

What is device memory used for?

A

Must be used for memory regions that cover peripheral control registers.

For example, if control registers was cached, we could never detect changes in the registers themselves. If we wanted to write to it, we would not write to the device itself, but the cache.

This shows that some of the optimisations that are permitted for normal memory would not be safe for peripheral registers.

55
Q

Name attributes of device memory

A

G or nG (Gathering or non-Gathering):
Multiple accesses to a device can be merged into a single transaction. This is likely to be done if it is part of the data transfer, but not if it is part of the control.

R or nG (Reordering or Non-reordering)

E or nE (Early write Acknowledge - similar to bufferable):
Can you tell a CPU immediately that a request has been done, and that it can continue. Or do you need to go all the way to a device to make sure the request has taken affect, and that the device is in the correct state before we continue.

56
Q

What 2 prominent speculative side channel attacks were published in 2018, and why were these special?

A

Spectre & Meltdown

Spectre attacks exploit core features of modern architectures.

They are special because there weren’t any immediate ways of mitigating these, as they exploit the design itself.

57
Q

What is the core problem of speculative side channel attacks?

A

Speculation

Speculation is heavily relied on in modern architectures to hide latency

Types:
- Control flow speculation
- Memory disambiguation speculation
- Exception speculation

58
Q

What is control-flow speculation?

A

branch resolution (taken/non-taken)
BTB targets - where to branch to

59
Q

What is Memory disambiguation speculation?

A

This is when we assume that stores and loads do not alias.

Have a younger load, issue it by assuming it is not dependent on an earlier store that has an unresolved address.

If the store turns out to have a matching address with the load, the load will have gotten the wrong stale data from the cache and has propagated it through the system. This must then be squashed.

60
Q

What is Exception speculation

A

This is when we assume that instruction will not normally cause and exception.

E.g. floating-point operations will cause an exception when dividing by 0. When they do, we need to roll-back and handle the exception before continuing.

61
Q

How can speculation be exploited?

A

Speculation can set the processor in an illegal state, in which secrets can leaks, or normally inaccessible data can be retrieved.

This state is always squashed before it becomes architecturally visible. This means that the execution will always be EVENTUALLY correct, but there can be mistakes during execution.

The exploitation needs to find a way to access this illegal data before it gets squashed. This can be done using “transmitters”

62
Q

How can “transmitters” be used to make data visible in the micro architecture?

A

Transmitters are certain operations within the processor, that affects the micro-architectural state. They are called transmitters because they in some ways transmit information about the data that is used for them.

The problem is, that certain aspects of micro-architectures are observable for the architectural states. It is possible to explicitly address certain operations in such a way as to retrieve information about the micro-architectural state.

If we use a transmitter operation, with illegal data, we can get that illegal data back afterwards, after it has been squash. Resulting in the illegal data now being visible in the architectural state.

Through select execution dependent on data, we can change the micro-architectural state to hold data (best way of doing this is by modifying caches). This data can be brought back into the architectural state afterwards.

63
Q

What is micro-architectural state?

A

The state that is part of the system, but not explicitly defined by the ISA.

Not well-defined

A matter of implementation

There is no security guarantees for these states.

64
Q

What is architectural state?

A

State explicitly defined by the ISA

65
Q

Describe the micro architectural state in caches

A
  • a load only defines that data must be retrieved from memory according to certain semantic, it does not say anything about the timing.
  • depending on the address of the load, we can have different latencies (L1, L2, L3, memory)
  • the timing is a part of the micro-architectural state
  • the implementation of caches, what they store and don’t, how they prefetch, are all micro-architectural state.
66
Q

Describe the example of how we can reveal secrets using cache-modification.

A

Assumptions:
- Have a sequence of data, where each data occupy a different cache line
- All our data lives in an inclusive L2 cache (meaning all lines in L1 is also in L2).

Firstly we flush all data elements in L1, leaving an empty L1 cache.

Then, we access a single data element. We know that the secret is a value between 1 and 20. The base address, is the first array element that is stored in the L2 cache.
So, we fetch the element at *(base + secret). If secret=3 we access the 4th element of the data-array in the L2 cache, and bring it to the L1 cache.

The access time of L1 is 5 cycles and 15 for L2. This is an observable difference when using timers in the system.

What we do, is time all possible cache lines that the secret can be in. Every cache line will take 15 cycles, except from the one containing the secret, as we have brought this up to the L1 cache.

Since we know that the access pattern is (base + secret), we can, by looking at the access-time-graph, deduce that the secret=3.

67
Q

Describe the 4 steps of the Spectre v1 attack

A

0: Mistrain a branch predictor, and clear a selection of cache (make sure all data elements is in the same level of cache)

1: Acquire illegal data (secrets) through bypassing bounds checking after mistraining (accessing data elements outside the bounds of our array)

2: Transmit the data to the architectural state (in to the cache), by using the secret as an address

3: Wait for squash, and then time cache lines to retrieve secret

68
Q

Describe the 4 steps of the Spectre v2 attack

A

In contrast to v1, instead of you being the only process running, the spectre v2 has a victim process.

Step 0: Locate a gadget, which is a series of operations associated with a function, that inadvertently transmit some data

Step 1: The attacker then figures out some place where there is a branch in the victims code, then takes that branch to figure out what its index into the Branch Target Buffer is. Then, we retrain the BTB to index into the gadget instead of the actual target.

Step 2: Now we let the victim program execute. This will now speculate using the BTB and jump to gadget where it will transmit secret.

Step 3: As the attacker will begin by flushing out the cache, they can now time the cache line to retrieve the secret. In this case, we are looking for the access with the longest access time. The reason for this is that we used to have all the cache lines in a shared cache. The victim process then hoisted the cache line into their core, making it take a longer time to access.

69
Q

Describe the Meltdown attack

A

More an exploitation of an implementation error, than exploiting speculation within the core.

Step 0: Set up a long chain of instructions, and clear possible cache targets

Step 1: Access kernel data. This will trigger an exception, but the exception handling is delayed (need to reach the head of the ROB). You are still given the data, though. A user process should not be able to access the data that the kernel uses, but in some systems this data is mapped into the user space so that when system calls are made, you don’t have to map the data in externally. This gives a better response time from the kernel.

Step 2: The kernel data is then transmitted using the secret as an address. Index into it based on some value based out of possible cache targets.

Step 3: Time cache lines to find the fastes line, and retrieve secret.

70
Q

Why can Meltdown be though of as an implementation error?

A

If you can detect that we have an exception, you should give back a dud value instead of the real data.

Doing this is a suggested way of mitigating this problem.

71
Q

What are the 3 main state-of-the-art mitigation strategies for speculative side channel attacks?

A

1: Making execution invisible

2: Delaying dangerous operations

3: Cleaning up micro-architecture

72
Q

Describe how making execution invisible can be done to mitigate side channel attacks

A

Don’t show what you are doing

For example, in regards to caches, cache lines don’t move from L2 to L1 and seem to be invisible (not modified at all), until speculation is done.

Caches are the most prevalent source of transmitting, but not the only one.

The idea is to “hide” changes to these various side-channels until they are non-speculative.

Con:
- requires extra storage - the work must be placed somewhere
- Need to make changes to coherence and consistency models to account for this
- Requires you to think of every possible visible angle and their complications, changes done to achieve this can for example move the problem such that secrets are transmitted through different components in another part of the micro architecture.

73
Q

Describe how delaying dangerous operations can be done to mitigate side channel attacks

A

Define a category of dangerous operations, and delay these while we do useful work elsewhere.

Either restrict the propagation of secrets (NDA), or delay transmitters that depend on secrets (DoM, STT)

NDA: Does not let potential secrets propagate through the system, won’t give anyone the data until we know it’s safe to do so. This is generally safe, but loses out on some potential performance

The next two both prevent execution of certain operations, that they believe will create an observable difference. Delaying transmitters requires knowing all transmitters ahead of time, this can be really hard as new attacks are discovered.

Delay-on-Miss: Does this on speculation on operations it knows will modify the L1/L2 cache state. Tracks general speculation.

Speculative Taint Tracking: Does this on data it knows comes from a potential illegal access. Need to track dangerous data, and by this also track general speculation.

74
Q

Describe how cleaning up micro-architecture can be done to mitigate side channel attacks

A

CleanupSpec

Need to track everything that was done during speculation, and be able to revert back to previous state. This can be very expensive, as we need to keep track of every attack vector.
After mispredict, restore state to how it was before speculation started.

Some of this can be handled by only updating state on commit (same as invisible), but some of it must be tracked.

Requires knowing all possible states that can be altered during speculation and used as transmitter, for the cleanup system to be efficient.

Architecture (11 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions