Trustworthy Systems

Prevention of microarchitectural timing channels in systems on chip

Authors

Nils Wistoff

ETH Zurich

Abstract

The rapid digitalisation of critical infrastructure and sensitive information underscores the importance of securing computing systems. A key requirement is the isolation of mutually untrusting programs that time-share hardware, in order to protect access keys and other secrets and prevent unauthorised access or control.

To enforce isolation, modern instruction set architectures (ISAs) provide memory protection mechanisms that control which memory regions an application can access. At the same time, systems on chip (SoCs) incorporate numerous microarchitectural optimisations aimed at maximising average instructions per cycle—such as caching recently accessed data and instructions in a hierarchy of fast memories close to the processor, predicting the outcome of branches based on execution history, and adapting main memory controller policies to access patterns—which introduce hidden, microarchitectural state that is defined by previous execution. Although otherwise invisible to software, this state inherently influences program timing.

Consequently, the execution of one program can affect the timing behaviour of another that time-shares the same hardware. This interference undermines isolation assumptions and enables the creation of microarchitectural timing channels to covertly leak information via timing variations introduced by microarchitectural state.

Closing these channels requires time protection: strict partitioning of shared microarchitectural state, either spatially—by restricting resource access to specific security domains—or temporally—by set- ting components to a history-independent state before reallocation. However, due to the transparency of microarchitectural components, software often lacks sufficient control to enforce such partitioning.

This thesis develops and evaluates hardware mechanisms that support the partitioning of shared microarchitectural state to sys- tematically eliminate microarchitectural timing channels. Beyond well-studied data-path structures, it identifies a previously underexplored class of timing channels arising from persistent control-plane state. It proposes architectural extensions that allow system software to explicitly enforce temporal isolation, and evaluates their efficacy and overhead across various system components, including processor cores, caches, interconnects, and memory controllers. Finally, it develops a formal verification methodology to prove the absence of microarchitectural timing channels in a given hardware design.

BibTeX Entry

  @phdthesis{Wistoff:phd,
    address          = {Zurich, CH},
    author           = {Nils Wistoff},
    month            = aug,
    paperurl         = {https://doi.org/10.3929/ethz-c-000804945},
    school           = {ETH Zurich},
    title            = {Prevention of Microarchitectural Timing Channels in Systems on Chip},
    year             = {2026}
  }

Download