microarchitectural timing analysis

Emerging hardware security threats—including cache, power, electromagnetic, and voltage side-channel attacks, as well as fault injection—pose severe risks to cloud, IoT, and smart devices. Current defenses—memory protection, trusted boot, PUFs, key management, and RISC-V security extensions—exhibit systemic limitations. Method: This project establishes the first unified framework integrating multi-dimensional attack modeling with cross-layer defense strategies, proposes a hardware security assessment methodology for heterogeneous architectures, and empirically analyzes Spectre/Meltdown, DPA, EMA, voltage glitching, cryptographic ISA extensions, and secure boot mechanisms. Contribution/Results: It uncovers unique challenges in root-of-trust construction within the RISC-V ecosystem and constructs the most comprehensive hardware security knowledge graph to date. The outcomes provide industry with systematic guidelines for developing side-channel-resistant processors and offer academia scalable technical pathways for innovating next-generation hardware security mechanisms.

Traditional cache-based side-channel attacks suffer from coarse granularity and limited applicability due to their reliance on cache access patterns or stall cycles. To address this, we propose MCHammer—a novel microarchitectural timing attack leveraging Machine Clear events. For the first time, our approach repurposes the CPU’s self-modifying code (SMC) detection mechanism—which triggers a Machine Clear—as a fine-grained, zero-memory-access, zero-stall-cycle side channel, thereby overcoming inherent limitations of cache-based techniques such as Flush+Reload. Through microarchitectural reverse engineering, precise event timing, controlled SMC triggering, and side-channel signal modeling, MCHammer enables high-precision secret key recovery. We experimentally validate the attack on real-world cryptographic software across multiple platforms, demonstrating both cross-platform practicality and tangible real-world threat impact.

This work addresses a long-overlooked yet critical vulnerability in MIPS embedded processors: severe cross-core microarchitectural side-channel leakage when simultaneous multithreading (SMT) is enabled. The authors propose MIPSBLEED, a novel framework that systematically uncovers timing-based information leakage across cores through the L1 data and instruction caches as well as the execution engine. By combining assembly-level probing, microarchitectural timing modeling, and quantitative leakage analysis, they construct a high-resolution, single-trace attack that requires no privileged access. Demonstrated on real hardware, the attack successfully recovers elliptic curve cryptography keys, confirming substantial information leakage from security-critical components. These findings underscore the urgent need for lightweight yet effective isolation mechanisms in SMT-enabled MIPS architectures.

This work addresses the detection and root-cause analysis of hardware fault-injection vulnerabilities in pre-silicon design. We propose a systematic, cross-abstraction-level verification methodology spanning RTL circuits, ISA semantics, and software behavior, instantiated on RISC-V. Our approach integrates RTL-level clock-glitch modeling, dynamic instruction tracing, and end-to-end behavioral validation to enable controllable fault injection and precise propagation-path tracking prior to tape-out. We uncover two previously unknown vulnerability classes: (1) instruction skipping causing critical memory values to remain unloaded, and (2) legitimate instructions being illegally invalidated, leading to control-flow hijacking. Furthermore, we introduce the first root-cause analysis framework bridging the physical layer to AI/ML application layers. Experimental validation successfully reproduces both vulnerabilities and demonstrates their capacity to induce critical misclassifications in AI inference tasks—establishing a reusable methodology for early-stage hardware security verification.

RISC-V processors lack dedicated microarchitectural side-channel—particularly cache-timing—security assessment tools. Method: This work systematically ports the mainstream x86-64 cache-timing vulnerability benchmark suite to the RISC-V ecosystem, establishing the first cross-ISA side-channel evaluation framework. Using this framework, we conduct empirical analyses on commercial RISC-V cores, including the T-Head C910 and SiFive U54/U74. Contribution/Results: We find that 37.5% of vulnerabilities are pervasive across all tested cores, while only 6.8% remain undetected; the C910 exhibits more complex cache-timing behavior, indicating elevated security risk. This study fills a critical gap in quantitative microarchitectural security assessment for RISC-V, providing a reusable methodology and empirical foundation for early vulnerability identification and security-aware processor design.

Microarchitectural timing channels enable implicit cross-security-boundary information leakage, undermining temporal isolation guarantees in secure systems. Method: This paper proposes the first full temporal isolation scheme for RISC-V, centered on an ISA-native timing fence instruction `fence.t` and a hardware-level full-state zeroing mechanism that systematically clears non-architectural core state to ensure history-independent context-switch latency bounds. Contribution/Results: We formalize the RISC-V ISA extension, adapt the seL4 microkernel, and implement the scheme in the open-source CVA6 processor. The solution eliminates all major on-core timing channels—including cache, branch predictor, and TLB-based channels—while incurring less than 1% performance overhead and negligible hardware cost. Crucially, it provides formally verifiable temporal isolation guarantees, establishing a foundation for high-assurance real-time and security-critical systems.

This work addresses the security implications of unintended bit flips in DRAM cells caused by charge leakage and interference, which jeopardize data integrity, confidentiality, and security mechanisms such as DRAM-based physically unclonable functions. For the first time, it establishes a direct link between device-level physical behavior and system-level security properties by introducing a quantifiable, cell-level vulnerability modeling framework. This framework integrates circuit-level charge leakage analysis, interference path modeling, and mapping to security attributes. The approach systematically reveals the non-uniformity and context dependence of DRAM vulnerability across diverse failure modes, offering both theoretical foundations and practical tools for evaluating and deploying DRAM in security-critical applications.

To address hardware-level security threats—such as Meltdown and Spectre—that exploit out-of-order and speculative execution to induce microarchitectural side-channel leaks, this paper proposes the first microarchitecture-level defense that eliminates such vulnerabilities at their root. Our approach integrates three synergistic mechanisms: cache isolation, dynamic control of speculative execution, and real-time monitoring of instruction flush behavior—collectively blocking leakage paths for sensitive data through microarchitectural components like caches. The solution defends against all major Meltdown and Spectre variants, extends to other memory-structure-based attacks, and uncovers two previously unknown side-channel attack classes. Experimental evaluation shows ≤5% performance overhead on typical applications—substantially lower than state-of-the-art software patches (up to 30%). This work establishes a general-purpose, low-overhead, and extensible hardware-level side-channel defense framework.

This work addresses the challenges of limited scalability and insufficient attribution accuracy in identifying root causes of power side-channel leakage during pre-silicon processor design. The paper introduces SPARC, a novel framework that enables, for the first time, automated and highly accurate end-to-end leakage detection and root-cause tracing in the pre-silicon phase. SPARC achieves this by performing macrocell-level information flow tracking and employing enhanced shadow logic to tag key-dependent switching activity, which is then correlated with software instructions through statistical leakage testing. Evaluation on multiple open-source RISC-V processors demonstrates that SPARC not only reproduces known vulnerabilities but also uncovers previously unknown microarchitectural side channels, while achieving an 8× speedup in single-trace simulation compared to existing approaches.

This study addresses the challenge that existing functional verification simulators struggle to efficiently generate large volumes of power traces under short-duration, minimally varied inputs, thereby hindering side-channel analysis during pre-silicon simulation. To overcome this limitation, this work proposes the first open-source Verilog simulator that integrates compiler-level performance, fully timed gate-level simulation, and runtime state manipulation capabilities. The tool enables multiple forked executions following a single initialization and supports pausing, inspecting, modifying, and reproducing simulation states without altering the design, thereby preserving precise timing and leakage characteristics. Experimental results demonstrate that the simulator achieves a 5.9× speedup over Icarus Verilog on an AES gate-level circuit, operates only 30% slower than Verilator while offering superior timing accuracy, and successfully recovers cryptographic keys via differential power analysis at both RTL and gate levels.

Modern CPU microarchitectures are highly complex and lack formal security abstractions—specifically, instruction-level side-channel leakage contracts—while manual construction of such contracts is prohibitively costly and heavily reliant on expert knowledge. This work proposes the first fully automated, template-free approach that synthesizes precise, complete, and formally reliable leakage contracts by combining black-box observations with automated reasoning to capture microarchitectural behavioral differences across instruction executions. Evaluated on both x86 and ARM processors, the method successfully generates high-fidelity contracts, achieving the first fully automated black-box synthesis of leakage contracts. This breakthrough overcomes the longstanding bottleneck of manual modeling and demonstrates the feasibility of automatically learning security contracts directly from black-box CPUs.