Emulating Covert Data Transmission on Heterogeneous SoCs

Recent works have highlighted the vulnerability of System-on-a-Chip (SoC) platforms against frequency-based covert channels. An attacker might be able to leverage vulnerabilities in the SoC’s firmware, the operating system, or the design tools to gain access to the underlying hardware and perform frequency modulation. Given the diversity of threats and the constant evolution of SoC platforms, it is not practical to study this attack model using physical devices. To address this issue, we propose to employ advanced simulation techniques. Our work targets heterogeneous SoCs which feature a processor system based on the ARM architecture plus an FPGA. We employ the full system simulation of gem5, which allows us to create a complete virtual-system and study the interaction between its components. We present the emulation of three frequency-based covert channels in gem5 v22 by showing that it is possible to replicate the covert transmission of data between different elements of the SoC. To ensure the repeatability of our experiments all the sources are released as Open-Source.