Apparatuses, methods and computer programs for executing an executable, and method for distributing software or firmwares
Various examples relate to apparatuses, methods, and computer programs for executing an executable, and to a method for distributing software or firmware. An apparatus for executing an executable comprises interface circuitry, machine-readable instructions, and processing circuitry for executing the machine-readable instructions to identify, for the executable, a trigger to activate or deactivate a noise injection mode during execution of the executable, the noise injection mode being suitable for introducing noise during execution of the executable, and activate or deactivate the noise injection mode based on the identified trigger.
1 . An apparatus for executing an executable, the apparatus comprising interface circuitry, machine-readable instructions, and processing circuitry for executing the machine-readable instructions to:
identify, for the executable, a trigger to activate or deactivate a noise injection mode during execution of the executable, the noise injection mode being suitable for introducing noise during execution of the executable;
obtain, from an execution manifest bundled with the executable, a desired signal-to-noise ratio for execution of the executable;
determine a desired amount of noise injection based on the desired signal-to-noise ratio; and
activate or deactivate the noise injection mode with the desired amount of noise injection based on the identified trigger.
2 . The apparatus according to claim 1 , wherein the processing circuitry is to execute the machine-readable instructions to activate or deactivate the noise injection mode in at least one of a runtime environment for executing the executable, a hypervisor hosting a virtual machine being used to execute the executable, an operating system being used to execute the executable and a hardware component of a computer system being used to execute the executable.
3 . The apparatus according to claim 2 , wherein the processing circuitry is to execute the machine-readable instructions to activate or deactivate the noise injection mode in the runtime environment for executing the executable, to activate or deactivate at least one of insertion of random delays by the runtime environment, execution of a pre-defined set of instructions to increase or decrease at least one of execution time, power consumption, heat emission, electromagnetic noise and sound, generation of random traffic on a bus of the computer system being used to execute the executable, and execution of an additional computational kernel on a processing unit being used to execute the executable in parallel with the execution of the executable.
4 . The apparatus according to claim 2 , wherein the processing circuitry is to execute the machine-readable instructions to activate or deactivate the noise injection mode in the hypervisor, operating system or hardware component, to activate or deactivate at least one of execution of a pre-defined set of instructions to increase or decrease at least one of execution time, power consumption, heat emission, electromagnetic noise and sound, generation of random traffic on a bus of the computer system being used to execute the executable, and execution of an additional computational kernel on a processing unit being used to execute the executable in parallel with the execution of the executable.
5 . The apparatus according to claim 1 , wherein the processing circuitry is to execute the machine-readable instructions to identify the trigger for activating the noise injection mode if at least a part of the executable is suspected to be vulnerable to a side-channel attack.
6 . The apparatus according to claim 5 , wherein the processing circuitry is to execute the machine-readable instructions to determine whether at least a part of the executable is suspected to be vulnerable to a side-channel attack based on at least one of a first data storage comprising information on executables that are vulnerable to a side-channel attack, a second data storage comprising information on libraries that are vulnerable to a side-channel attack, an execution manifest that is bundled with the executable, an execution profile that is bundled with the executable, a computer system-wide policy, a deploy site-wide policy and an enterprise-wide policy.
7 . The apparatus according to claim 5 , wherein the processing circuitry is to execute the machine-readable instructions to determine whether at least a part of the executable is suspected to be vulnerable to a side-channel attack by processing the executable to determine an execution profile, the execution profile comprising information on one or more sections of code and/or one or more memory regions triggering activation or deactivation of the noise injection mode.
8 . The apparatus according to claim 1 , wherein the processing circuitry is to execute the machine-readable instructions to identify the trigger to activate or deactivate the noise injection mode during execution of the executable, such that the noise injection mode is activated when a pre-defined set of instructions is executed, when a pre-defined memory region is accessed, or when a pre-defined library is called, and deactivated thereafter.
9 . The apparatus according to claim 1 , wherein the processing circuitry is to execute the machine-readable instructions to adjust the desired signal-to-noise ratio based on a vulnerability of the executable to side-channel attacks.
10 . The apparatus according to claim 1 , wherein the processing circuitry is to execute the machine-readable instructions to determine the desired amount of noise injection further based on a load of a computer system being used to execute the executable.
11 . The apparatus according to claim 1 , wherein the processing circuitry is to execute the machine-readable instructions to determine the desired amount of noise injection by performing a self-test at startup of at least one of a runtime environment for executing the executable, a hypervisor hosting a virtual machine being used to execute the executable, an operating system being used to execute the executable, and a computer system being used to execute the executable.
12 . The apparatus according to claim 1 , wherein the processing circuitry is to execute the machine-readable instructions to determine the desired amount of noise injection based on a Minimum Traces to Disclosure, MTD, parameter.
13 . The apparatus according to claim 1 , wherein the processing circuitry is to execute the machine-readable instructions to detect a side-channel attack being performed during execution of the executable, and to determine the desired amount of noise injection further based on whether a side-channel attack is being performed during execution of the executable.
14 . The apparatus according to claim 1 , wherein the processing circuitry is to execute the machine-readable instructions to process an execution manifest that is bundled with the executable, the execution manifest indicating whether noise injection is required when executing the executable, and to execute the executable based on the execution manifest.
15 . A method for executing an executable, the method comprising:
identifying, for the executable, a trigger to activate or deactivate a noise injection mode during execution of the executable, the noise injection mode being suitable for introducing noise during execution of the executable;
obtaining, from an execution manifest bundled with the executable, a desired signal-to-noise ratio for execution of the executable;
determining a desired amount of noise injection based on the desired signal-to-noise ratio; and
activating or deactivating the noise injection mode with the desired amount of noise injection based on the identified trigger.
16 . A non-transitory machine-readable storage medium including program code, when executed, to cause a machine to perform the method of claim 15 .
17 . A method for executing an executable, the method comprising:
processing an execution manifest, the execution manifest:
indicating whether activating a noise injection mode is required when executing the executable, the noise injection mode being suitable for introducing noise during execution of the executable,
specifying a desired signal-to-noise ratio for execution of the executable;
determining, on the basis of the desired signal-to-noise ratio, a desired amount of noise injection; and
executing the executable based on the execution manifest, by activating or deactivating the noise injection mode with the desired amount of noise injection.
18 . The method according to claim 17 , wherein the execution manifest is bundled with the executable, or wherein the manifest is obtained separate from the executable.
19 . The method according to claim 18 , wherein the processing of the execution manifest is mandated by policy, such that executing the executable is disabled upon absence of the execution manifest.
20 . A non-transitory machine-readable storage medium including program code, when executed, to cause a machine to perform the method of claim 19 .
21 . A method for distributing software or firmware, the method comprising:
providing an executable of the software or firmware; and
providing an execution manifest by bundling the execution manifest with the executable, the execution manifest:
indicating whether activating a noise injection mode is required when executing the executable, the noise injection mode being suitable for introducing noise during execution of the executable, and
specifying a desired signal-to-noise ratio for execution of the executable, wherein the desired amount of noise injection is determined based on the desired signal-to-noise ratio.
22 . The method according to claim 21 , wherein the execution manifest is bundled with the executable by an original software vendor of the executable, or wherein the manifest is provided alongside the executable.