
%!TEX root = main.tex

Using the DRAM power modulation alone enables us to build a covert channel implementation with
the following very desirable properties.

\begin{enumerate}
  \item It can can transmit at high rates with low error rates, as defined by TCSEC~\cite{united1985department}.
  \item It uses simple algorithms for encoding and decoding.
  \item It is robust against application interference.
\end{enumerate}

One important feature of DRAM power is that, by manipulating memory chunks of different sizes,
we get different power consumption profiles. This can yield a potentially large number
of distinguishable states. Further study using other classifiers can help us estimate the number
of useful states.

Combining the DRAM and CPU power states, we achieved the throughput of 1800 bps with 10\% error, and 2400 with 15\% error
under the notebook and desktop setups, respectively.
This significantly improves upon Miedl and Thiele's results~\cite{miedl2018security}, in which only CPU power modulation is considered,
as shown in Table~\ref{table:mt_vs_our}.

\begin{table}[]
\centering
\caption{Comparison between our covert channel and the one by Miedl and Thiele~\cite{miedl2018security}.}
\label{table:mt_vs_our}
\setlength\tabcolsep{5pt}
\def\arraystretch{1.2}
\begin{tabular}{@{}lllllll@{}}
\toprule
\multicolumn{3}{c}{\textbf{Miedl and Thiele}~\cite{miedl2018security}} &  & \multicolumn{3}{c}{\textbf{Our work}} \\
Processor & Transfer rate & Error rate &  & Processor & Transfer rate & Error rate \\ \cmidrule(r){1-3} \cmidrule(l){5-7}
\begin{tabular}[c]{@{}l@{}}Intel Xeon\\ E5-2690\\ (octa-core)\end{tabular} & 200 bps & $\approx$15\% &  & \begin{tabular}[c]{@{}l@{}}Intel Core\\ i7-8700\\ (hexa-core)\end{tabular} & 2400 bps & $\approx$15\% \\ \cmidrule(r){1-3} \cmidrule(l){5-7}
\begin{tabular}[c]{@{}l@{}}Intel Core \\ i7-4710MQ\\ (quad-core)\end{tabular} & 1000 bps & $\approx$15\% &  & \begin{tabular}[c]{@{}l@{}}Intel Core \\ i5-4210U\\ (dual-core)\end{tabular} & 1800 bps & $\approx$10\% \\ \bottomrule
\end{tabular}
\end{table}

It is important to emphasize that both our platforms have lower numbers of cores than the corresponding ones used by
Miedl and Thiele's. It is reasonable to expect the throughput to be even higher in a machine with more
cores, since it has more power states. However our results suggest that in a system with more cores,
the covert channel robustness against application interference is significantly compromised,
in particular under workloads similar to LINPACK.

Our implementation also improves upon Miedl and Thiele's work with respect to the robustness against application interference,
mainly because the way \texttt{memset} with
large memory chunks affects the DRAM power profile appears to be very different than other common
applications.
Furthermore, understanding which benchmarks affect the quality of this covert channel can shed
some light on countermeasures against side-channel attacks.

The data and source code are publicly available at \url{https://www.ime.usp.br/~tpaiva/}.