Publications related to SpecROP: Speculative Exploitation of ROP Chains

Highly Parallel RTL Simulation

Verification and testing of hardware heavily relies on cycle-accurate simulation of RTL. As single-processor performance is growing only slowly, conventional, single-threaded RTL simulation is becoming impractical for increasingly complex chip designs and ...

EPFL2024

Instruction-Level Power Side-Channel Leakage Evaluation of Soft-Core CPUs on Shared FPGAs

Mirjana Stojilovic, Ognjen Glamocanin, Mathias Josef Payer, Shashwat Shrivastava, Jinwei Yao, Nour Ardo

Side-channel disassembly attacks recover CPU instructions from power or electromagnetic side-channel traces measured during code execution. These attacks typically rely on physical access, proximity to the victim device, and high sampling rate measuring in ...

2023

Compilation and Design Space Exploration of Dataflow Programs for Heterogeneous CPU-GPU Platforms

Aurélien François Gilbert Bloch

Today's continued increase in demand for processing power, despite the slowdown of Moore's law, has led to an increase in processor count, which has resulted in energy consumption and distribution problems. To address this, there is a growing trend toward ...

EPFL2023

Near Collision Attack Against Grain V1

Willi Meier, Subhadeep Banik, Daniel Patrick Collins

A near collision attack against the Grain v1 stream cipher was proposed by Zhang et al. in Eurocrypt 18. The attack uses the fact that two internal states of the stream cipher with very low hamming distance between them, produce similar keystream sequences ...

2023

LAQy: Efficient and Reusable Query Approximations via Lazy Sampling

Anastasia Ailamaki, Periklis Chrysogelos, Viktor Sanca

Modern analytical engines rely on Approximate Query Processing (AQP) to provide faster response times than the hardware allows for exact query answering. However, existing AQP methods impose steep performance penalties as workload unpredictability increase ...

2023

Evaluating, Exploiting, and Hiding Power Side-Channel Leakage of Remote FPGAs

Ognjen Glamocanin

The pervasive adoption of field-programmable gate arrays (FPGAs) in both cyber-physical systems and the cloud has raised many security issues. Being integrated circuits, FPGAs are susceptible to fault and power side-channel attacks, which require physical ...

EPFL2023

Latency Interfaces for Systems Code

Rishabh Ramesh Iyer

This thesis demonstrates that it is feasible for systems code to expose a latency interface that describes its latency and related side effects for all inputs, just like the code's semantic interface describes its functionality and related side effects. S ...

EPFL2023

Micro BTB: A High Performance and Storage Efficient Last-Level Branch Target Buffer for Servers

Vishal Gupta

High-performance branch target buffers (BTBs) and the L1I cache are key to high-performance front-end. Modern branch predictors are highly accurate, but with an increase in code footprint in modern-day server workloads, BTB and L1I misses are still frequen ...

ASSOC COMPUTING MACHINERY2022

Electrical-Level Attacks on CPUs, FPGAs, and GPUs: Survey and Implications in the Heterogeneous Era

Mirjana Stojilovic, Dina Gamaleldin Ahmed Shawky Mahmoud

Given the need for efficient high-performance computing, computer architectures combining CPUs, GPUs, and FPGAs are nowadays prevalent. However, each of these components suffers from electrical-level security risks. Moving to heterogeneous systems, with th ...

2022

A Deep-Learning Approach to Side-Channel Based CPU Disassembly at Design Time

Mirjana Stojilovic

Side-channel CPU disassembly is a side-channel attack that allows an adversary to recover instructions executed by a processor. Not only does such an attack compromise code confidentiality, it can also reveal critical information on the system’s internals. ...

IEEE2022

Micro-architectural Analysis of Database Workloads

Utku Sirin

Database workloads have significantly evolved in the past twenty years. Traditional database systems that are mainly used to serve Online Transactional Processing (OLTP) workloads evolved into specialized database systems that are optimized for particular ...

EPFL2021

Leaking Secrets Through Compressed Caches

Daniel Felipe Forero Sanchez

We offer the first security analysis of cache compression, a promising architectural technique that is likely to appear in future mainstream processors. We find that cache compression has novel security implications because the compressibility of a cache l ...

IEEE COMPUTER SOC2021

A Coarse-mesh Methodology for the Analysis of One and Two-phase Nuclear Reactor Thermal-hydraulics in a Multi-physics Context

Stefan Radman

The analysis of nuclear reactors for performance and safety assessment benefits from the use of computational tools. In this context, this work aims at the development and application of a thermal-hydraulics methodology and related software that respond to ...

EPFL2021

Micro-architectural analysis of in-memory OLTP: Revisited

Anastasia Ailamaki, Danica Porobic, Utku Sirin

Micro-architectural behavior of traditional disk-based online transaction processing (OLTP) systems has been investigated extensively over the past couple of decades. Results show that traditional OLTP systems mostly under-utilize the available micro-archi ...

2021

X-Attack: Remote Activation of Satisfiability Don’t-Care Hardware Trojans on Shared FPGAs

Mirjana Stojilovic, Wei Hu, Dina Gamaleldin Ahmed Shawky Mahmoud

Albeit very appealing, FPGA multitenancy in the cloud computing environment is currently on hold due to a number of recently discovered vulnerabilities to side-channel attacks and covert communication. In this work, we successfully demonstrate a new attack ...

IEEE2020

Pipeline Synthesis and Optimization from Branched Feedback Dataflow Programs

Marco Mattavelli, Anatoly Prihozhy, Endri Bezati, Simone Casale Brunet

Large dataflow designs are a result of behavioral specification of modern complex digital systems and/or a result of unfolding and transforming looped and branched programs. Since deep-submicron silicon technology provides large amounts of available resour ...

SPRINGER2020

mu RAI: Securing Embedded Systems with Return Address Integrity

Mathias Josef Payer

Embedded systems are deployed in security critical environments and have become a prominent target for remote attacks. Microcontroller-based systems (MCUS) are particularly vulnerable due to a combination of limited resources and low level programming whic ...

INTERNET SOC2020

Analysis of Functional Errors Produced by Long-Term Workload-Dependent BTI Degradation in Ultra-Low Power Processors

David Atienza Alonso, Ruben Braojos Lopez, Loris Gérard Duch, Miguel Peon Quiros, Alexandre Sébastien Julien Levisse

Aging effects in digital circuits change the switching characteristics of their transistors, resulting in timing violations that can lead to functional errors at the system level. In particular, BTI is a degradation effect that changes the threshold voltag ...

2020

Speculative Dataflow Circuits

Paolo Ienne, Lana Josipovic, Andrea Guerrieri

With FPGAs facing broader application domains, the conversion of imperative languages into dataflow circuits has been recently revamped as a way to overcome the conservatism of statically scheduled high-level synthesis. Apart from the ability to extract pa ...

ASSOC COMPUTING MACHINERY2019

SMoTherSpectre: Exploiting Speculative Execution through Port Contention

Babak Falsafi, Atri Bhattacharyya, Mathias Josef Payer

Spectre, Meltdown, and related attacks have demonstrated that kernels, hypervisors, trusted execution environments, and browsers are prone to information disclosure through micro-architectural weaknesses. However, it remains unclear as to what extent other ...

ACM2019