Systematic Prevention of On-Core Timing Channels by Full Temporal Partitioning

TL;DR

This work tackles microarchitectural timing channels by proposing time-protection hardware for on-core resources in an open RISC-V setting. It introduces a temporal fence instruction, fence.t, and a principled erasure mechanism called Microreset to ensure a history-independent context switch. Through implementation on CVA6 and seL4, the authors show that Microreset achieves complete channel elimination with negligible hardware cost and sub-1% performance impact, outperforming software-only and basic-flush approaches. The findings demonstrate a practical, low-overhead path to secure enclaves and OS kernels against timing channels, enabling robust security boundary enforcement in contemporary systems. The approach has broad relevance for secure execution in multi-domain environments and for hardware-software contracts supporting time protection.

Abstract

Microarchitectural timing channels enable unwanted information flow across security boundaries, violating fundamental security assumptions. They leverage timing variations of several state-holding microarchitectural components and have been demonstrated across instruction set architectures and hardware implementations. Analogously to memory protection, Ge et al. have proposed time protection for preventing information leakage via timing channels. They also showed that time protection calls for hardware support. This work leverages the open and extensible RISC-V instruction set architecture (ISA) to introduce the temporal fence instruction fence.t, which provides the required mechanisms by clearing vulnerable microarchitectural state and guaranteeing a history-independent context-switch latency. We propose and discuss three different implementations of fence.t and implement them on an experimental version of the seL4 microkernel and CVA6, an open-source, in-order, application class, 64-bit RISC-V core. We find that a complete, systematic, ISA-supported erasure of all non-architectural core components is the most effective implementation while featuring a low implementation effort, a minimal performance overhead of less than 1%, and negligible hardware costs.

Figures (9)

• Figure 1: Threat model: a Trojan actively leaking data via shared hardware resources.
• Figure 2: Illustration of the Microreset.
• Figure 3: Hardware platform.
• Figure 4: A prime-and-probe attack on a cache.
• Figure 5: HW/SW stack of the evaluation framework.