A Survey of Techniques for Improving Security of GPUs <s> Detecting leakage through taint-analysis <s> Graphics processing units (GPUs) are increasingly common on desktops, servers, and embedded platforms. In this article, we report on new security issues related to CUDA, which is the most widespread platform for GPU computing. In particular, details and proofs-of-concept are provided about novel vulnerabilities to which CUDA architectures are subject. We show how such vulnerabilities can be exploited to cause severe information leakage. As a case study, we experimentally show how to exploit one of these vulnerabilities on a GPU implementation of the AES encryption algorithm. Finally, we also suggest software patches and alternative approaches to tackle the presented vulnerabilities. <s> BIB001 </s> A Survey of Techniques for Improving Security of GPUs <s> Detecting leakage through taint-analysis <s> Dynamic tainting tracks the influence of certain inputs (taint sources) through execution and it is a powerful tool for information flow analysis and security. Taint tracking has primarily targeted CPU program executions. Motivated by recent recognition of information leaking in GPU memory and GPU-resident malware, this paper presents the first design and prototype implementation of a taint tracking system on GPUs. Our design combines a static binary instrumentation with dynamic tainting at runtime. We present new performance optimizations by exploiting unique GPU characteristics--a large portion of instructions on GPU runtime parameters and constant memory can be safely eliminated from taint tracking; large GPU register file allows fast maintenance of a hot portion of the taint map. Experiments show that these techniques improved the GPU taint tracking performance by 5 to 20 times for a range of image processing, data encryption, and deep learning applications. We further demonstrate that GPU taint tracking can enable zeroing sensitive data to minimize information leaking as well as identifying and countering GPU-resident malware. <s> BIB002
Taint-analysis tracks the flow of "tainted" data, i.e., sensitive input that transforms over the course of execution to affect memory locations. This allows detecting the information-leakage, clearing the sensitive data after their scope and also identifying the presence of malware. Hayes et al. BIB002 implement a GPU taint-tracking scheme which uses static binary instrumentation for performing dynamic taint tracking of GPU applications. They divide instruction operands into two types, viz., taintable and untaintable, based on whether they can be tainted at runtime. Examples of untaintable operands include built-in variables such as thread ID, block ID, block dimension, pointer-type kernel parameters, user-specified constants and loop-induction variables. Examples of taintable sources are image, plain-text, encryption key, etc. Every thread tracks information-flow on its own. Their analysis proceeds iteratively and each iteration has two steps. In forward step, taintable/un-taintable operands are flagged at the points of taint state-transition, e.g., storing the constant value in a register switches it to the untaintable type. In backward step, operands which can affect memory value are flagged. Remaining variables cannot flow to memory even if they are taintable, such as stack-frame pointers, loop-counters, etc. Then, only those operands which are flagged in both forward and backward steps are tracked, and this reduces the overhead of taint-tracking significantly. The taint record is stored in GPU registers, which reduces its access latency compared to storing it in LoM or GlM. Further, compared to CPUs, GPUs have much larger register file   and not all registers are used by most kernels. Since registers/ShM/LoM/GlM have different lifetimes, their scheme handles them differently and clears them at different times. LoM and GlM taints are cleared at the completion of each kernel and program, respectively. The ShM is cleared after all threads of a block complete their work. Registers are cleared by each thread before exiting. Their scheme does not require VM emulation or a dynamic instrumentation framework which is generally unavailable on GPUs. Their approach enables protection against the register-spilling based attack BIB001 and incurs only small performance overhead. Further, their approach allows tracking data transfers between CPU and GPU, which is especially useful in fused CPU-GPU systems. Furthermore, by using their approach, a suspicious program can be prevented from accessing uninitialized data left by other programs/users.