Constructing Covert Channel on Intel CPU-iGPU platform

Most modern multi-core CPUs are implemented in System-on-a-Chip (SoC), where CPU and integrated Graphics Processing Unit (iGPU) share physical memory and some microarchitectures. iGPUs provide horsepower required by computeintensive tasks, taking off CPU's heavy workload. These tasks include rendering graphics, executing cryptographic or machine learning algorithms. While iGPU utilization has been expanded to various fields, now covering security-sensitive applications as well, possible security threats that could follow has not received enough attention yet. In this paper, we present a novel covert channel attack on heterogeneous processor platforms (CPU-iGPU) by using cache activity on LLC as a communication channel. To successfully mount this attack, iGPU-side trojan finds LLC eviction set on Shared Virtual Memory (SVM), which will create contention on target cache line of CPU-side spy. We successfully construct covert channel between a CPU process and an iGPU kernel, making it the first micro-architectural timing attack on Intel CPU-iGPU platform. We also evaluate performance of the attack in terms of channel bandwidth and bit error rate.