A Survey of Techniques for Improving Security of GPUs <s> Terms and concepts <s> Information leakage through covert channels and side channels is becoming a serious problem, especially when these are enhanced by modern processor architecture features. We show how processor architecture features such as simultaneous multithreading, control speculation and shared caches can inadvertently accelerate such covert channels or enable new covert channels and side channels. We first illustrate the reality and severity of this problem by describing concrete attacks. We identify two new covert channels. We show orders of magnitude increases in covert channel capacities. We then present two solutions, Selective Partitioning and the novel Random Permutation Cache (RPCache). The RPCache can thwart most cache-based software side channel attacks, with minimal hardware costs and negligible performance impact. <s> BIB001 </s> A Survey of Techniques for Improving Security of GPUs <s> Terms and concepts <s> Abstract General-Purpose computing on a Graphics Processing Unit (GPGPU) involves leveraging commodity GPUs as massively parallel processing units. GPGPU is an emerging computing paradigm for high-performance and data-intensive computations such as cryptographic operations. Although GPGPU is an attractive solution for accelerating modern cryptographic operations, the security challenges that stem from utilizing commodity GPUs remain an unresolved problem. In this paper, we present an On-demand Bootstrapping Mechanism for Isolated cryptographic operations (OBMI). OBMI transforms commodity GPUs into a securely isolated processing core for various cryptographic operations while maintaining cost-effective computations. By leveraging System Management Mode (SMM), a privileged execution mode provided by x86 architectures, OBMI implements a program and a secret key into the GPU such that they are securely isolated during the acceleration of cryptographic operations, even in the presence of compromised kernels. Our approach does not require an additional hardware-abstraction layer such as a hypervisor or micro-kernel, and it does not entail modifying the GPU driver. An evaluation of the proposed OBMI demonstrated that even adversaries with kernel privileges cannot gain access to the secret key, and it also showed that the proposed mechanism incurs negligible performance degradation for both the CPU and GPU. <s> BIB002 </s> A Survey of Techniques for Improving Security of GPUs <s> Terms and concepts <s> Modern graphics processing units (GPUs) are using increasingly larger register file (RF) which occupies a large fraction of GPU core area and is very frequently accessed. This makes RF vulnerable to soft-errors (SE). In this paper, we present two techniques for improving SE resilience of GPU RF. First, we propose compressing the RF values for reducing the number of vulnerable bits. We leverage value similarity and the presence of narrow-width values to perform compression at warp or thread-level, respectively. Second, we propose selective hardening to design a portion of register entry with SE immune circuits. By collectively using these techniques, higher resilience can be provided with lower overhead. Without hardening, our warp and thread-level compression techniques bring 47.0% and 40.8% reduction in SE vulnerability, respectively. <s> BIB003 </s> A Survey of Techniques for Improving Security of GPUs <s> Terms and concepts <s> Graphics processing units (GPUs) are becoming default accelerators in many domains such as high-performance computing (HPC), deep learning, and virtual/augmented reality. Recently, GPUs have also shown significant speedups for a variety of security-sensitive applications such as encryptions. These speedups have largely benefited from the high memory bandwidth and compute throughput of GPUs. One of the key features to optimize the memory bandwidth consumption in GPUs is intra-warp memory access coalescing, which merges memory requests originating from different threads of a single warp into as few cache lines as possible. However, this coalescing feature is also shown to make the GPUs prone to the correlation timing attacks as it exposes the relationship between the execution time and the number of coalesced accesses. Consequently, an attacker is able to correctly reveal an AES private key via repeatedly gathering encrypted data and execution time on a GPU. In this work, we propose a series of defense mechanisms to alleviate such timing attacks by carefully trading off performance for improved security. Specifically, we propose to randomize the coalescing logic such that the attacker finds it hard to guess the correct number of coalesced accesses generated. To this end, we propose to randomize: a) the granularity (called as subwarp) at which warp threads are grouped together for coalescing, and b) the threads selected by each subwarp for coalescing. Such randomization techniques result in three mechanisms: fixed-sized subwarp (FSS), random-sized subwarp (RSS), and random-threaded subwarp (RTS). We find that the combination of these security mechanisms offers 24- to 961-times improvement in the security against the correlation timing attacks with 5 to 28% performance degradation. <s> BIB004
We now introduce some concepts which will be used throughout this paper. We refer the reader to previous works for a detailed background on GPU architecture   BIB003 and AES encryption algorithm BIB004 . cudaContext: It is a data type which stores device configuration during runtime such as error codes, loaded modules containing device code and allocated device memory. These parameters are useful for controlling the device. cl_mem: In OpenCL execution model, a memory object is a handle to a portion of global memory. cl_mem is an object type used for describing the memory objects  . Shader: A shader refers to a program which processes a particular stage of a graphics engine for calculating rendering effects. For example, a fragment shader is a shader stage which processes fragments into multiple colors and a depth value. The vertex shader is another stage which processes individual vertices. Memory access coalescing: It refers to merging of memory requests of different threads of a single warp into as few cache lines as possible. Soft and hard booting: In soft (or warm) rebooting, the system is restarted without turning off the power supply to the system. In hard (or cold) rebooting, the power to the system is first turned-off (i.e., shut-down) and then turned-on which results in rebooting the system. SMM: SMM is a special operating mode in x86 CPUs which is used for performing tasks related to systemcontrol, e.g., hardware management BIB002 . SMM can provision a memory portion which can be accessed only by SMM and not hypervisor or OS kernel. Further, in SMM, only a trusted program, namely "system management interrupt" (SMI) can run. All other tasks, including any malicious task, are suspended and they cannot interrupt the SMI program. Note that a hypervisor is a firmware which launches and runs virtual machines. DMA: DMA allows certain devices to directly access main memory without requiring the intervention of CPU. Buffer overflow: Buffer overflow refers to writing data outside the boundary of the buffer to the adjacent locations. It can lead to program crashes, data corruption, and security breaches. For example, stack overflow by a thread can impact execution of other threads by overwriting other memory spaces. Canary: In memory management, a canary is the memory location which does not store useful data, and is generally placed just before the return address of a function. An adversary generally attempts to cause a 1. The following acronyms are frequently used in this paper: advanced encryption standard (AES), address space layout randomization (ASLR), bandwidth (BW), covert channel (CC), compute unified device architecture (CUDA), direct memory access (DMA), denial of service (DoS), error correcting code (ECC), functional unit (FU), global/local/shared memory (GlM/LoM/ShM), input output memory management unit (IOMMU), input output (I/O), memory management unit (MMU), peripheral component interconnect (PCI), parallel thread execution (PTX), single instruction multiple thread (SIMT), streaming multiprocessor (SM), system management mode (SMM), shared virtual memory (SVM), virtual machine (VM). buffer overflow to overwrite the return address for redirecting the execution to a malicious code. However, use of a canary ensures that the buffer overflow also overwrites the canary value. Then, before using the return address, the canary can be checked. If it has been changed, overwriting of the return address can be easily detected. Covert and side-channel: A channel refers to a medium through which sensitive data is leaked. If the channel is hidden, it is termed as "covert channel". A covert channel is created intentionally and is not otherwise meant for communication. The adversary tries to conceal its existence from the victim. A "side-channel" is created incidentally, where the adversary gets sensitive information from the characteristics of the system's operation BIB001 . For example, if the timing/power values of the encryption algorithm depend on the key, then, based on the timing/power measurements, an adversary can guess the key used in encryption. In a side-channel, there is no communication, but only leakage of sensitive information through the side-channel. Denial-of-service attack: In a DoS attack, the adversary tries to make the device unavailable by temporarily or permanently hampering its services. This may be done by overloading the system with useless requests which prohibits handling of genuine requests from a benign user. Due to this, a DoS attack can be detected, which is different from other attacks, such as side-channel attack, where the system is generally not harmed and hence, no evidence of the attack remains.