论文标题
MES攻击：基于相互排除和同步的软件控制的秘密通道
MES-Attacks: Software-Controlled Covert Channels based on Mutual Exclusion and Synchronization
论文作者
论文摘要
多进程并发可有效提高程序效率和最大化CPU利用率。通过管理共享硬件和软件资源的相互排除和同步机制（MESM）来确保并发的正确执行。我们提出了MES-Attacks，这是一套基于MESM的软件控制的秘密频道攻击，以传输机密信息。 MES-Attacks提供了几个优点：1）秘密频道是在软件级别构建的，可以在任何硬件上部署； 2）封闭的资源份额可确保干扰低的渠道质量，并难以检测到它们； 3）它利用系统的软件资源，因此很难隔离。我们在Windows和Linux上使用不同的MESM构建了秘密通道，包括事件，计时器，Fileleckex，Mutex，Smaphore和Flock。实验结果表明，在局部，交叉盒和交叉VM的情况下，这些秘密通道可以分别达到13.105 kb/s，12.383 kb/s和6.552 kb/s的传输速率，其中均误差率均低于1 \％。
Multi-process concurrency is effective in improving program efficiency and maximizing CPU utilization. The correct execution of concurrency is ensured by the mutual exclusion and synchronization mechanism (MESM) that manages the shared hardware and software resources. We propose MES-Attacks, a new set of software-controlled covert channel attacks based on MESM to transmit confidential information. MES-Attacks offer several advantages: 1) the covert channels are constructed at software level and can be deployed on any hardware; 2) closed share of resource ensures the quality of the channels with low interference and makes them hard to be detected; and 3) it utilizes the system's software resources which are abound and hence difficult to isolate. We built covert channels using different MESMs on Windows and Linux, including Event, Timer, FileLockEX, Mutex, Semaphore and flock. Experimental results demonstrate that these covert channels can achieve transmission rate of 13.105 kb/s, 12.383 kb/s, and 6.552 kb/s, respectively in the scenarios of local, cross-sandbox and cross-VM, where the bit error rates are all under 1\%.
