Syed Kamran Haider

PrORAM: dynamic prefetcher for oblivious RAM

Oblivious RAM (ORAM) is an established technique to hide the access pattern to an untrusted storage system. With ORAM, a curious adversary cannot tell what address the user is accessing when observing the bits moving between the user and the storage system. All existing ORAM schemes achieve obliviousness by adding redundancy to the storage system, i.e., each access is turned into multiple random accesses. Such redundancy incurs a large performance overhead.Although traditional data prefetching techniques successfully hide memory latency in DRAM based systems, it turns out that they do not work well for ORAM because ORAM does not have enough memory bandwidth available for issuing prefetch requests. In this paper, we exploit ORAM locality by taking advantage of the ORAM internal structures. While it might seem apparent that obliviousness and locality are two contradictory concepts, we challenge this intuition by exploiting data locality in ORAM without sacrificing security. In particular, we propose a dynamic ORAM prefetching technique called PrORAM (Dynamic Prefetcher for ORAM) and comprehensively explore its design space. PrORAM detects data locality in programs at runtime, and exploits the locality without leaking any information on the access pattern. Our simulation results show that with PrORAM, the performance of ORA M can be significantly improved. PrORAM achieves an average performance gain of 20% over the baseline ORA M for memory intensive benchmarks among Splash2 and 5.5% for SP EC06 workloads. The peiformance gain for YCSB and TPCC in DBMS benchmarks is 23.6% and 5% respectively. On average, PrORAM offers twice the performance gain than that offered by a static super block scheme.

Lease/release: architectural support for scaling contended data structures

High memory contention is generally agreed to be a worst-case scenario for concurrent data structures. There has been a significant amount of research effort spent investigating designs which minimize contention, and several programming techniques have been proposed to mitigate its effects. However, there are currently few architectural mechanisms to allow scaling contended data structures at high thread counts. In this paper, we investigate hardware support for scalable contended data structures. We propose Lease/Release, a simple addition to standard directory-based MSI cache coherence protocols, allowing participants to lease memory, at the granularity of cache lines, by delaying coherence messages for a short, bounded period of time. Our analysis shows that Lease/Release can significantly reduce the overheads of contention for both non-blocking (lock-free) and lock-based data structure implementations, while ensuring that no deadlocks are introduced. We validate Lease/Release empirically on the Graphite multiprocessor simulator, on a range of data structures, including queue, stack, and priority queue implementations, as well as on transactional applications. Results show that Lease/Release consistently improves both throughput and energy usage, by up to 5x, both for lock-free and lock-based data structure designs.

Exploring the performance implications of memory safety primitives in many-core processors executing multi-threaded workloads

Security is a vital consideration for todays processor architectures, both at the software and hardware layers. However, security schemes are known to incur significant performance overheads. For example, buffer overflow protection schemes perform software checks for bounds on program data structures, and incur performance overheads that are up to several orders of magnitude. To mitigate these overheads, prior works focus on either changing the security scheme itself, or selectively apply the security scheme to minimize program vulnerabilities. Most of these works also focus primarily on single core processors, with no prior work done in the context of multicore processors. In this paper, we show how increasing thread counts can help hide the latency overheads of security schemes. We also analyze the architectural implications in the context of multucores, and the insights and challenges associated with applying these security schemes on mutithreaded workloads.

Advancing the state-of-the-art in hardware Trojans design

Electronic Design Automation (EDA) industry heavily reuses third party IP cores which are vulnerable to insertion of Hardware Trojans (HTs) at design time by third party IP core providers. State of the art research has shown that existing HT detection techniques, which claim to detect all publicly available HT benchmarks, can still be defeated by carefully designing new sophisticated HTs. The reason being that these techniques consider the HT landscape to be limited only to the publicly known HT benchmarks. However the adversary is not limited to these HTs and may devise new HT design principles to bypass these countermeasures. In this paper, we discover certain crucial properties of trigger activated HTs which lead to the definition of an exponentially large class of Deterministic Hardware Trojans HD that an adversary can (but is not limited to) design. The discovered properties serve as HT design principles which help us understand the tremendous ways available to an adversary to design a HT, and show that the existing publicly known HT benchmarks are just the tip of the iceberg on this huge landscape.

Connecting the dots: Privacy leakage via write-access patterns to the main memory

Data-dependent access patterns of an application to an untrusted storage system are notorious for leaking sensitive information about the users data. Previous research has shown how an adversary capable of monitoring both read and write requests issued to the memory can correlate them with the application to learn its sensitive data. However, information leakage through only the write access patterns is less obvious and not well studied in the current literature. In this work, we demonstrate an actual attack on power-side-channel resistant Montgomerys ladder based modular exponentiation algorithm commonly used in public key cryptography. We infer the complete 512-bit secret exponent in ∼ 3 5 minutes by virtue of just the write access patterns of the algorithm to the main memory. In order to learn the victim algorithms write access patterns under realistic settings, we exploit a compromised DMA device to take frequent snapshots of the applications address space, and then run a simple differential analysis on these snapshots to find the write access sequence. The attack has been shown on an Intel Core(TM) i7-4790 3.60GHz processor based system. Although our exploitation strategy to infer the write access patterns has certain limitations, it conveys the underlying message that even if only the write access sequence is given, the applications sensitive information can be learned. We also discuss some techniques to overcome these limitations, and also some countermeasures to prevent such attacks.

Virtual Fingerprint - Image-Based Authentication Increases Privacy for Users of Mouse-Replacement Interfaces

Current secondary user authentication methods are imperfect. They either rely heavily on a user’s ability to remember key preferences and phrases or they involve providing authentication on multiple devices. However, malicious attacks that compromise a user’s device or discover personal information about the user are becoming more sophisticated and increasing in number. Users who rely on mouse-replacement interfaces face additional privacy concerns when monitored or assisted by caregivers. Our authentication method proposes a way of quantifying a user’s personality traits by observing his selection of images. This method would not be as vulnerable to malicious attacks as current methods are because the method is based on psychological observations that can not be replicated by anyone other than the correct user. As a preliminary evaluation, we created a survey consisting of slides of images and asked participants to click through them. The results indicated our proposed authentication method has clear potential to address these issues.

M-MAP: Multi-factor memory authentication for secure embedded processors

The challenges faced in securing embedded computing systems against multifaceted memory safety vulnerabilities have prompted great interest in the development of memory safety countermeasures. These countermeasures either provide protection only against their corresponding type of vulnerabilities, or incur substantial architectural modifications and overheads in order to provide complete safety, which makes them infeasible for embedded systems. In this paper, we propose M-MAP: a comprehensive system based on multi-factor memory authentication for complete memory safety. We examine certain crucial implications of composing memory integrity verification and bounds checking schemes in a comprehensive system. Based on these implications, we implement M-MAP with hardware based memory integrity verification and software based bounds checking to achieve a balance between hardware modifications and performance. We demonstrate that M-MAP implemented on top of a lightweight out-of-order processor delivers complete memory safety with only 32% performance overhead on average, while incurring minimal hardware modifications, and area overhead.

Lease/Release: Architectural Support for Scaling Contended Data Structures

High memory contention is generally agreed to be a worst-case scenario for concurrent data structures. There has been a significant amount of research effort spent investigating designs that minimize contention, and several programming techniques have been proposed to mitigate its effects. However, there are currently few architectural mechanisms to allow scaling contended data structures at high thread counts. In this article, we investigate hardware support for scalable contended data structures. We propose Lease/Release, a simple addition to standard directory-based MESI cache coherence protocols, allowing participants to lease memory, at the granularity of cache lines, by delaying coherence messages for a short, bounded period of time. Our analysis shows that Lease/Release can significantly reduce the overheads of contention for both non-blocking (lock-free) and lock-based data structure implementations while ensuring that no deadlocks are introduced. We validate Lease/Release empirically on the Graphite multiprocessor simulator on a range of data structures, including queue, stack, and priority queue implementations, as well as on transactional applications. Results show that Lease/Release consistently improves both throughput and energy usage, by up to 5x, both for lock-free and lock-based data structure designs.