National Natural Science Foundation of China (61802375, 61602325, 61876111, 61877040); Project of Beijing Municipal Education Commission (KM20190028005); Open Research Fund of State Key Laboratory of Computer Architecture (Institute of Computing Technology, Chinese Academy of Sciences) (CARCH201920)
Computing devices are processing and storing more and more sensitive information, such as passwords and personal fingerprints, so higher security requirements are required for them. With the development of physical attacks, a new kind of attack called board level physical attacks is developed, and this kind of attack can obtain secrets in the operating system by attacking hardware components at the printed circuit board (PCB) level. This newly proposed attack only uses simple tools, its cost is inexpensive, and it can be streamlined simply, so it can be leveraged by attackers to form new underground industry easily. Therefore it is a new security threat and challenge for operating systems. A common defense against this kind of attack is to extend a specialized memory encryption engine to the CPU, but most current computing devices are not equipped with such hardware security mechanisms. Thus, the academic fields and industrial fields propose software-based techniques to defend board level physical attacks, and these techniques have been becoming a research hotspot in recent years. This paper deeply analyzes the development of these techniques, summarizes their advantages and disadvantages, and discusses their development trends. First, the paper introduces the definition, threat model and some real-world attack cases of the board level physical attacks. Second, the paper describes the building blocks relied by the software-based techniques to defense the board level physical attacks. Third, the paper makes a survey of and categorizes the related work on the software-based defense technology according to their protection domains. At last, the paper analyzes the advantages and disadvantages of the technology, gives suggestions on how to implement it in practice, and discusses some development trends of this technology.