通过织物：TEE增强型FPGA-MPSoC系统上的跨世界热隐蔽通道.pdf

1、KIT The Research University in the Helmholtz Associationces.itec.kit.eduThrough Fabric:A Cross-world Thermal Covert Channel on TEE-enhanced FPGA-MPSoC SystemsHassan Nassar,Jeferson Gonzalez-Gomez,Varun Manjunath,Lars Bauer,and Jrg HenkelASP-DAC 2025ces.itec.kit.edu2Hassan Nassar ASP-DAC 2025,Tokyo,J

2、apanAgendaBackgroundCovert ChannelsState of the ArtAssumptions and LimitationsThrough FabricDesign and ImplementationEvaluationChannel PerformanceConclusionces.itec.kit.edu3Hassan Nassar ASP-DAC 2025,Tokyo,JapanBackground:Covert-Channel AttacksEmerging security threats“Hidden”communication channelGo

3、al:Extract information out of the(trusted)systemces.itec.kit.edu4Hassan Nassar ASP-DAC 2025,Tokyo,JapanCommunication between two malicious applications through temperature.Power intensive,controlled CPU activityMalware:(isolated env)has access to private information.TransmitterSpy:(normal env)has ac

4、cess to I/O and other apps.ReceiverThermal-based Covert Channel Attacksces.itec.kit.edu5Hassan Nassar ASP-DAC 2025,Tokyo,JapanState of the ArtTrusted Execution EnvironmentsAssumption:TEEs ensure isolation between secure and normal worldsLimitation:Vulnerable to covert and side-channel attacksThermal

5、 Covert ChannelsAssumption:Temperature variations can enable covert communicationLimitation:Several state-of-the-art works are limited to simulation onlyFPGA-based Covert ChannelsAssumption:FPGAs enable covert channels via shared resourcesLimitation:Detectable malicious hardware limits stealthces.it

6、ec.kit.edu6Hassan Nassar ASP-DAC 2025,Tokyo,JapanThermal-based covert channelTargets FPGA-MPSoCsBreaks trusted execution environmentUses FPGA as a shared medium to transmit data and break isolationOpen-source AES accelerator used as heating mechanismThrough Fabric Hardware Designces.itec.kit.edu7Has