%!TEX root = main.tex


\subsection{Threat model}

Our threat model is very similar to the one considered by Miedl and Thiele~\cite{miedl2018security}
when building covert channels based on RAPL CPU power measurements.
The spy process can read the RAPL power consumption
estimates on the PP0 and DRAM domains.
In Linux, the spy can use the \texttt{powercap} module to read the power consumption provided by the RAPL registers.
This does not require any privileged permission.

The spy runs in two phases. First it records the power consumption
in a certain time interval, and then it analyses the data to decode the message.
The Trojan is a simple, possibly multi-thread, C program that uses simple memory operations,
and does not have access to the RAPL measurements.
It does not explicitly communicate with the spy, neither has access to the Internet.

\subsection{Experimental setup}

In the following sections, we describe experiments and results which are highly dependent on the
architecture of our experimental environments. We tested the covert channel in two environments,
which are described next.


\begin{description}
    \item[Notebook setup] The notebook considered is an HP Pavilion 14-v064br.
        This notebook has 8GB of RAM and an Intel Haswell i5-4210U CPU with base frequency of
        1.70GHz. This CPU has two cores and supports 4 threads.
        The sizes of the caches L1, L2, and L3, are, respectively, 32K, 256K, and 3MB.

    \item[Desktop setup]
        This environment consists of a 16GB of RAM computer provided with an Intel Coffee Lake i7-8700 CPU
        with base frequency of 3.20GHz. This CPU has two 6 and supports 12 threads.
        The sizes of the caches L1, L2, and L3, are, respectively, 32K, 256K, and 12MB.
\end{description}


\begin{figure}[!ht]
  \centering
  \includegraphics[scale=1]{graphs/raplcomp.pdf}
  \caption{The four domains for which one can measure power consumption using the RAPL interface on an Intel Haswell i5 4210U, which is our notebook's CPU.}
  \label{fig:raplcomp}
\end{figure}

RAPL offers power measurements on four domains: Package, PP0, PP1, and DRAM. The Package domain
corresponds the CPU package, which contains the cores, cache, memory controller and possibly processor graphics.
PP0 (Power Plane 0) corresponds to the power consumption of the cores, and PP1 (Power Plane 1) contains the
processor graphics component consumption. Not surprisingly, the DRAM domain measures the DRAM power consumption.
The RAPL registers are updated at a frequency of about 1000Hz~\cite{intel64and}.
Figure~\ref{fig:raplcomp} illustrates the RAPL domains for the notebook setup.




