  GPUs are increasingly being used in security applications, especially for
accelerating encryption/decryption. While GPUs are an attractive platform in
terms of performance, the security of these devices raises a number of
concerns. One vulnerability is the data-dependent timing information, which can
be exploited by adversary to recover the encryption key. Memory system features
are frequently exploited since they create detectable timing variations. In
this paper, our attack model is a coalescing attack, which leverages a critical
GPU microarchitectural feature -- the coalescing unit. As multiple concurrent
GPU memory requests can refer to the same cache block, the coalescing unit
collapses them into a single memory transaction. The access time of an
encryption kernel is dependent on the number of transactions. Correlation
between a guessed key value and the associated timing samples can be exploited
to recover the secret key. In this paper, a series of hardware/software
countermeasures are proposed to obfuscate the memory timing side channel,
making the GPU more resilient without impacting performance. Our hardware-based
approach attempts to randomize the width of the coalescing unit to lower the
signal-to-noise ratio. We present a hierarchical Miss Status Holding Register
(MSHR) design that can merge transactions across different warps. This feature
boosts performance, while, at the same time, secures the execution. We also
present a software-based approach to permute the organization of critical data
structures, significantly changing the coalescing behavior and introducing a
high degree of randomness. Equipped with our new protections, the effort to
launch a successful attack is increased up to 1433X . 178X, while also
improving encryption/decryption performance up to 7%.
