STATIC ANALYSIS FOR DISCOVERY OF TIMING ATTACK VULNERABILITIES IN A COMPUTER SOFTWARE APPLICATION

摘要

Discovering timing attack vulnerabilities in a computer software application by statically analyzing instructions of a computer software application to identify multiple possible execution paths traversing any of the instructions, calculating, for each of the possible execution paths, a cost associated with the execution of the instructions traversed by the possible execution path, comparing the costs of at least two of the possible execution paths having inputs of the same size, and identifying as a timing attack vulnerability any of the compared possible execution paths whose cost differs, by at least a predetermined amount, from the cost of any other of the compared possible execution paths.