Source-linked AI summary
Thermal Covert Channels on Multi-core Platforms
Ramya Jayaram Masti, Devendra Rai, Aanjhan Ranganathan, Christian Müller, Lothar Thiele, Srdjan Capkun
TL;DR
The paper addresses whether thermal information can circumvent strong isolation based on resource partitioning in multi-core systems. It exploits thermal persistence and cross-core heat propagation to build side and covert channels under spatial and temporal partitioning. Experiments demonstrate covert communication up to 12.5 bps and application profiling on neighboring cores.
Problem
Resource partitioning may not prevent information leakage through exposed processor temperature data, but the feasibility of thermal side and covert channels requires investigation.
Method
The paper exploits thermal capacitance, resistance, and cross-core heat propagation to construct channels between isolated processes.
Results
The experiments achieve covert communication throughput of up to 12.5 bps and profile applications running on neighboring cores.
Takeaways & Limitations
Thermal channels can circumvent isolation guarantees provided by temporal and spatial partitioning on commodity multi-core systems.
Takeaways & Limitations
Fine-grained exfiltration such as deducing AES or RSA keys remains open because sensors have ±1°C resolution and refresh every 2 ms.
Abstract
from arXiv · showhide
Side channels remain a challenge to information flow control and security in modern computing platforms. Resource partitioning techniques that minimise the number of shared resources among processes are often used to address this challenge. In this work, we focus on multi-core platforms and we demonstrate that even seemingly strong isolation techniques based on dedicated cores and memory can be circumvented through the use of thermal side channels. Specifically, we show that the processor core temperature can be used both as a side channel as well as a covert communication channel even when the system implements strong spatial and temporal partitioning. Our experiments on an x86-based platform demonstrate covert thermal channels that achieve up to 12.5 bps and a weak side channel that can detect processes executed on neighbouring cores. This work therefore shows a limitation in the isolation that can be achieved on existing multi-core systems.
1 Introduction
The paper examines whether thermal information can bypass resource-partitioning isolation on multi-core systems. It demonstrates thermal side channels and covert communication across dedicated cores and memory, including under spatial and temporal partitioning.
- Side channels threaten information-flow control and can support data exfiltration or covert exchange between colluding applications.
- Dedicated cores and memory reduce some co-location risks, but multi-core platforms continue to expose shared-resource leakage.
- Thermal capacitance and resistance leave remnant heat after computation, allowing information to leak to a later process.
- Heat also propagates across the chip, allowing processes on other cores to observe information about a peer’s computation.
- The paper measures thermal covert-channel throughput, studies frequency and process location, and demonstrates limited application identification from neighbouring-core traces.
2 Background and Motivation
The background motivates thermal channels as a remaining information-flow risk despite resource partitioning. The study focuses on whether exposed core-temperature data enables side channels and covert communication across isolated processes.
- Thermal sensors support processor safety, power management, cooling, and increasingly user-configurable thermal policies.
- Sensor availability and topology vary across processor vendors and families, including per-core and whole-chip temperature monitoring.
- Resource partitioning can reduce the software Trusted Computing Base and create independent execution containers.
- Partitioning has been proposed to reduce side channels by minimising shared resources such as caches and bus bandwidth.
- The paper investigates the feasibility and throughput of thermal side and covert channels between processes on different cores despite partitioning.
3 Thermal Behaviour of x86 Platforms
The paper characterizes temperature sensing and thermal behavior on Intel x86 platforms. Core temperature responds to workload, frequency, and neighboring-core activity, creating observable persistence and propagation effects.
- 3.1 Temperature Sensors in Intel Processors: Intel processors use per-core digital thermal sensors, typically with ±1°C resolution, while Linux exposes refreshed readings through the coretemp interface.
- 3.2 Example Temperature Trace: 25 ms after RSA decryption begins, core temperature rises 5°C from approximately 35°C to 40°C before increasing slowly toward saturation.
- 3.2 Example Temperature Trace: After execution stops, temperature falls to 38°C in about 25 ms and requires an additional 11 s to reach 35°C.
- 3.2 Example Temperature Trace: Thermal capacitance and resistance make computation-induced temperature changes observable after execution has stopped.
- 3.3 Factors Influencing a Core’s Temperature: Higher processor frequencies produce more heat and higher saturation temperatures during CPU-intensive workloads.
- 3.3 Factors Influencing a Core’s Temperature: A CPU-intensive workload on core 3 changes neighboring-core sensor readings, with lower saturation temperatures at greater distances and asymmetric propagation.
4 Exploiting Thermal Behaviour
Thermal behavior can circumvent both spatial and temporal partitioning because remnant heat persists across executions and heat propagates between neighboring cores. The paper identifies these mechanisms and the practical challenges of constructing thermal channels on current x86 platforms.
- Thermal side channels can circumvent both spatial and temporal isolation techniques in multi-core systems.
- Remnant heat allows a later process to infer information about a preceding computation, especially when both use the same core.Temperature variations remain observable after computation stops, enabling leakage across time-multiplexed execution.
- Heat propagation between processor cores enables inference about neighboring computations and covert communication between colluding processes.Thermal conductivity causes computation-induced heat to affect neighboring cores, undermining spatial partitioning.
- Constructing thermal channels is constrained by uncontrolled temperature effects, limited sensor resolution, and fan-based cooling.These factors affect the rate, extent, and fineness of observable temperature variations on current x86 platforms.
5 Covert Communication Using Thermal Channels
The paper constructs thermal covert channels under spatial and temporal partitioning by encoding bits through heat generated on a source core and reading temperature at a sink. Experiments show communication is feasible, but throughput depends on timing, processor frequency, core distance, errors, and workload conditions.
- Experimental setup: The experimental setup uses cpusets to isolate source and sink applications spatially or temporally on an Intel Xeon platform.The source performs continuous RSA decryption, while the sink records its own core’s temperature.
- Encoding and decoding: ON-OFF keying sends bit ‘1’ by running RSA decryption to generate heat and bit ‘0’ by remaining idle.The source must run long enough for heat to affect the neighbouring sink core’s temperature.
- Spatial partitioning: 11% average errors at Tb=750 ms and 100% synchronisation across 10 tests demonstrate spatially isolated communication between neighbouring cores.At a two-hop distance, transmission achieved 1 bit in 1.5 s with an 18.33% (±4.21) error rate.
- Spatial partitioning: 0.33 bps is the effective one-hop throughput at Tb=750 ms after Hamming (7,4) correction, compared with 1.33 bps without errors.Lower processor frequency and greater source–sink distance further reduce throughput or increase errors.
- Limitations: Throughput estimates are representative upper bounds because actual performance depends on the machine, workloads, and additional processes that perturb sink temperature.Additional workloads can increase communication errors and lower throughput.
- Temporal partitioning: 12.5 bps is the effective throughput reported for temporally partitioned communication using Tb=10 ms and Hamming(7,4) correction.The raw channel has up to 10% errors, and the experiments minimise noise by isolating the source and sink from other workloads.
6 Thermal Channels for Unauthorised Profiling
The paper studies whether neighbouring-core temperature traces can reveal a victim process despite spatial isolation. Experiments show meaningful within-application correlation, but substantial confusion among CPU-intensive applications and sensor limitations constrain finer-grained profiling.
- Thermal side channels can enable unauthorised profiling of processes across strongly spatially partitioned cores.
- Goal and Intuition of the Attack: The attacker monitors its own core and correlates its temperature trace with a reference trace for the suspected victim application.The setup assumes only attacker and victim activity on adjacent cores, with no access to the neighbour’s sensor trace.
- Experiments and Analysis: Five CPU-intensive applications were run on a victim core while neighbouring-core temperature traces were collected and repeated five times per application.The applications were RSA decryption, ADPCM, Quick Sort, BitCount, and BasicMath; each run lasted 200 ms.
- Experiments and Analysis: 85% correlation was observed for RSA in seven of ten same-application pairs, while cross-application comparisons produced 28% false positives at the same threshold.Same-application traces generally correlated at ≥80%, whereas different CPU-intensive applications also reached ≥75%.
- ±1°C sensor resolution and a 2 ms refresh interval leave fine-grained thermal exfiltration of AES or RSA keys unresolved.
7 Discussion
The discussion examines why restricting temperature access is difficult and why related thermal signals remain available. It also proposes thermal profiling as a possible security application for detecting anomalous execution.
- Countermeasures: Restricting temperature-sensor access is difficult because guest operating systems may need thermal data for scheduling and detecting misbehaving processes.
- Countermeasures: Clock skew, fan speed, and dynamically scaled frequency can continue leaking thermal-state information even when temperature sensors are restricted.
- Countermeasures: Because these signals are shared across cores or core subsets, they can still provide a signalling mechanism.
- Countermeasures: Separating processes spatially and temporally may limit thermal channels but wastes resources and lowers utilisation.
- Thermal Fingerprinting For Security: Thermal profiling may help detect anomalous behaviour because computation-driven temperature changes are difficult to avoid.
8 Related Work
Prior work covers thermal management, thermal attacks, and other x86 side channels, but the paper identifies a gap in demonstrated thermal covert communication on commodity multi-core systems. Existing partitioning approaches do not completely eliminate temperature-based channels.
- Thermal Channels and Attacks: Before this work, thermal covert channels had been discussed or implemented mainly on FPGA boards, with fan-speed transmission also explored.
- Thermal Channels and Attacks: Prior studies used temperature variations for processor faults, sensitive-information extraction, and coarse-grained estimates of machine load or resource utilisation.
- Temperature-based Denial-of-Service Attacks: Thermal-management mechanisms have also been associated with denial-of-service through processor slowdowns or thermal hotspots.
- Covert channels on x86-systems: x86 side-channel research includes cache, bus-contention, network-stack, file-system, and input-device channels supporting covert exchange or exfiltration.
- Covert channels on x86-systems: Partitioning caches and bus bandwidth can mitigate corresponding channels, but such partitioning does not completely eliminate temperature-based channels.
- Thermal Monitoring of Processors: Thermal-management research addresses sensor placement, dynamic temperature control, cooling, hardware design, and microarchitecture.
- Thermal Monitoring of Processors: Thermal profiling has also been studied for detecting compromised embedded processes and designing schedulers that avoid thermal fingerprints.
9 Conclusion
The paper demonstrates thermal side and covert channels on commodity multi-core systems that can circumvent isolation based on temporal and spatial partitioning. It reports covert communication up to 12.5 bps and highlights unresolved security trade-offs from exposing thermal data.
- Thermal channels can circumvent isolation guarantees provided by temporal and spatial partitioning on commodity multi-core systems.
- 12.5 bps is the reported maximum throughput for covert communication between processes using thermal channels.
- Exposing temperature information supports user-centred thermal management but creates tension between efficiency and security.