Timing-based side and covert channels in processor caches continue to be a threat to modern computers. This work shows for the first time, a systematic, large-scale analysis of Arm devices and the detailed results of attacks the processors are vulnerable to. Compared to x86, Arm uses different architectures, microarchitectural implementations, cache replacement policies, etc., which affects how attacks can be launched, and how security testing for the vulnerabilities should be done. To evaluate security, this paper presents security benchmarks specifically developed for testing Arm processors and their caches. The benchmarks are evaluated with sensitivity tests, which examine how sensitive the benchmarks are to having a correct configuration in the testing phase. Further, to evaluate a large number of devices, this work leverages a novel approach of using a cloud-based Arm device testbed for architectural and security research on timing channels and runs the benchmarks on 34 different physical devices. In parallel, there has been much interest in secure caches to defend the various attacks. Consequently, this paper also investigates secure cache architectures using proposed benchmarks. Especially, this paper implements and evaluates secure PL and RF caches, showing the security of PL and RF caches, but also uncovers new weaknesses.

This article surveys the landscape of security verification approaches and techniques for computer systems at various levels: from a software-application level all the way to the physical hardware level. Different existing projects are compared, based on the tools used and security aspects being examined. Since many systems require both hardware and software components to work together to provide the system’s promised security protections, it is not sufficient to verify just the software levels or just the hardware levels in a mutually exclusive fashion. This survey especially highlights system levels that are verified by the different existing projects and presents to the readers the state of the art in hardware and software system security verification. Few approaches come close to providing full-system verification, and there is still much room for improvement.

Compute-in-memory (CiM) architecture is an emerging energy-efficient processing paradigm that has attracted widespread attention in AI and Internet of Things (IoT) applications. To protect statically stored sensitive data in CiM, designers have implemented various hardware obfuscation techniques in CiM architectures. However, we observe that existing CiM obfuscation defense strategies are based on straightforward static-key deployment strategies, which pose vulnerabilities from the perspective of key-pruning algorithms for de-obfuscation. This work proposes CiMSAT, a CiM de-obfuscation methodology based on Boolean satisfiability (SAT) theory. We conduct the first security analysis specifically tailored to the storage and mixed-signal computing features of CiM architecture, which are two key challenges to de-obfuscate existing state-of-the-art CiM defenses. To model storage units, we innovatively fit and utilize the "no-inference-value" obfuscated data for function approximation. To reconstruct mixed-signal circuits, we design bias-tolerant SAT to address the biases introduced by the approximation. With the proposed workflow, we investigate and evaluate all the existing 14 CiM obfuscation architectures using our de-obfuscation framework. We model a total of 176 defense vectors derived from different defense techniques and parameters, among which 158 (90%) can be de-obfuscated and returned the keys within 1,000 seconds and 172 (98%) defenses can be recovered within 10⁵ seconds (approximately one day). We further reload the keys into CiM simulators with obfuscation, achieving an average of 97% and 95% accuracy recovery in widely adopted MNIST and CIFAR-10 classification applications in CiM obfuscation, respectively.

This article discusses a recently developed test suite for checking timingbased vulnerabilities in processor caches, which has revealed the insecurity of today's processor caches. The susceptibility of caches to these vulnerabilities calls for more research on secure processor caches.