A cache side channel attack defense method based on a RISC-V architecture trusted execution environment
By introducing group index randomization and delayed purging mechanisms into the RISC-V architecture cache system, the security and performance issues of TEE in cache side-channel attacks are solved, achieving comprehensive and reliable cache protection suitable for multi-core processors.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- ZHEJIANG UNIV
- Filing Date
- 2022-11-02
- Publication Date
- 2026-08-04
AI Technical Summary
Existing TEEs lack reliable defenses against cache side-channel attacks, and the defense methods may introduce significant performance overhead, making them difficult to apply in real-world scenarios.
A cache side-channel attack defense method based on RISC-V architecture is adopted. This method uses a group index randomization mechanism based on security domain and hashing in the first-level cache module and a group index randomization mechanism based on cryptographic computation in the second-level cache module. A delayed purging mechanism is also introduced into the cache system. Combined with the extended TileLink bus protocol, this method defends against attacks based on access conflicts and purging instructions.
It provides comprehensive, reliable, and efficient cache protection, enhancing security, reducing performance overhead, and is suitable for multi-core processor scenarios. It also works in conjunction with TEE software to improve defense efficiency and flexibility.
Smart Images
Figure CN115878515B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of cache security, and more specifically, to a method for defending against cache side-channel attacks based on a trusted execution environment with a RISC-V architecture. Background Technology
[0002] A Trusted Execution Environment (TEE) is a secure execution environment built through hardware and software collaboration, isolated from the general execution environment. It protects the confidentiality and integrity of programs and data loaded into it. The core mechanism of a TEE is isolation; the isolated area can be considered a security domain, such as the enclave in Intel SGX, the normal world and secure world in ARM TrustZone, and the secure virtual machine in AMD SEV. Currently, TEEs are widely used in digital rights management, mobile payments, mobile device authentication, cloud services, and secure modular programming.
[0003] However, mainstream industry-standard TEEs (Track-Based Execution Environments) have not provided reliable defense against cache side-channel attacks. These attacks exploit the hardware characteristics of processor caches, resulting in a wide-ranging and highly dangerous attack. Specifically, caches possess the following properties that attackers can exploit:
[0004] (1) There are significant differences in access latency between different levels of cache and main memory. Attackers can infer the location of target data by the difference in memory access latency.
[0005] (2) The cache is shared between different threads. When a thread loads a new cache block, it can swap out the cache blocks of other threads. Attackers can take advantage of these two properties to change the state of other threads' cache blocks by controlling thread access, or to infer the access behavior of other threads by the interference of the controlled thread's cache block.
[0006] (3) In some architectures with cache block clearing instructions, attackers can directly use such instructions to change the state of cache blocks.
[0007] Based on these properties, attackers can implement a variety of attacks, such as speculating on the execution status of victim programs, indirectly leaking confidential information, or constructing covert channels that bypass system monitoring mechanisms. According to their implementation methods, these attacks can be broadly categorized into two types: access violation-based attacks and cleanup command-based attacks. Previous research has demonstrated that cross-security domain cache side-channel attacks can be implemented in most commercial TEEs. While some RISC-V platform trusted execution environment solutions, such as Keystone and Penglai, provide cache protection mechanisms, the methods employed not only introduce significant performance overhead but also fail to defend against attacks targeting different cache levels.
[0008] In summary, existing TEEs mainly face two problems in the field of buffer side-channel:
[0009] (1) Most TEEs fail to provide reliable protection against cache side-channel attacks, or have limited protection against a limited range of attacks, and still pose significant security risks.
[0010] (2) Although some TEEs provide cache protection, they also introduce significant performance overhead, making them difficult to apply in real-world scenarios.
[0011] To address the aforementioned issues, this invention aims to enhance the security of TEE caching, providing defense against access violation-based and purging command-based attacks, and offering comprehensive protection for all levels of the cache. Simultaneously, it must balance performance, ensuring that the performance overhead introduced by the defense mechanism is low. Furthermore, the efficiency and flexibility of the defense can be further improved by working in conjunction with TEE software. Summary of the Invention
[0012] The purpose of this invention is to address the cache side-channel attack problem in trusted execution environments (TEEs) by providing a reliable and efficient cache side-channel attack defense method based on the RISC-V architecture. Specifically, this invention redesigns the high-speed cache hardware architecture in the processor, defending against cache-based side-channel attacks through specific hardware functional logic. This includes using a group index randomization mechanism based on security domains and hashing to defend the first-level cache module against access collision-based attacks, using a group index randomization mechanism based on cryptographic computation to defend the second-level cache module against access collision-based attacks, and using a delayed purge mechanism to defend the entire cache architecture against purge instruction-based attacks.
[0013] This invention is achieved through the following technical methods:
[0014] This invention discloses a cache side-channel attack defense method based on a trusted execution environment of RISC-V architecture. The defense method is used for a system-on-a-chip composed of a RISC-V architecture central processor, cache system, memory, etc. The cache system includes a first-level cache module and a second-level cache module.
[0015] A group index randomization mechanism based on security domains and hashing is used in the first-level cache module to defend against access collision-based attacks.
[0016] The second-level cache module uses a group index randomization mechanism based on cryptographic computation to defend against access collision-based attacks.
[0017] The two-level cache module employs a set-associative design, along with a random replacement strategy and a path skew design.
[0018] Use a delayed purging mechanism in the caching system to defend against attacks based on purging instructions;
[0019] Use the extended TileLink bus protocol in the caching system to maintain cache consistency;
[0020] The first-level cache module is connected to the central processing unit, and the second-level cache module is connected to the first-level cache module via the TileLink bus, and is also connected to the memory via the TileLink bus.
[0021] Furthermore, the defense method includes three defense mechanisms, which work simultaneously to defend against corresponding attacks:
[0022] When the central processing unit accesses the L1 cache module, the L1 cache module uses a set index randomization mechanism based on security domains and hashes to calculate the cache set index to access the data;
[0023] When the first-level cache accesses the second-level cache, it transmits signals to the second-level cache through the TileLink bus. The second-level cache uses a group index randomization mechanism based on cryptographic calculation to calculate the cache group index to access the data.
[0024] When the central processing unit executes a cache block clearing instruction, the delayed clearing mechanism coordinates the first and second level cache modules through the TileLink bus to jointly complete the safe clearing operation.
[0025] Furthermore, the first-level cache module is core-private for the central processing unit (CPU). In the case of a single-core CPU, the second-level cache module is core-private; in the case of a multi-core CPU, the second-level cache module is shared among the cores.
[0026] Furthermore, the path skew technology can be applied to the above-mentioned cache modules at all levels. In the first-level cache module, the group index randomization mechanism based on security domain and hashing binds a unique path skew random value to each path of the cache module. In the second-level cache module, the group index randomization mechanism based on encrypted computation deploys an encrypted module for each cache path, and inputs different keys and handle parameters to calculate the index for each path.
[0027] Furthermore, the group index randomization mechanism based on security domain and hash first obtains the number of the currently running security domain from the processor register and maps it to a unique key. Then, it performs a random shift operation on the part of the physical address accessed by the processor excluding the offset bit, XORs it with the aforementioned key, and performs an Xorshift operation. Finally, it truncates the result to the lower bits at the random offset as the group index of the first-level cache module. The random values of the random shift and the random offset are both taken from the skew random value.
[0028] Furthermore, the group index randomization mechanism based on cryptographic computation uses an adjustable block cipher. The input plaintext for the cryptographic computation is the part of the accessed physical address excluding the offset bit. The input key and the handle are unique values randomly generated during hardware instantiation. The low-order bits of the output ciphertext are truncated and used as the group index of the second-level cache.
[0029] Furthermore, the delayed clearing mechanism marks the cache block cleared by the clearing instruction as a "zombie" state and executes other operations of the clearing instruction normally. When the "zombie" cache block is accessed again, the cache block is determined to be valid according to the specific access operation, thereby eliminating the time delay difference before and after the clearing instruction is executed.
[0030] Furthermore, the TileLink protocol is extended to support three security mechanisms. Since addresses may migrate between different security domains, the group index randomization mechanism based on security domains and hashes dynamically uses different security domain numbers to calculate the cache index for the address. The consistency protocol transmits and maintains the security domain information of each cache block to ensure consistency before and after migration. Since the clearing instruction is directed to the entire caching method, the consistency protocol is responsible for propagating the control signal of the delayed clearing mechanism within the cache consistency domain. In addition, the consistency protocol is also responsible for tracking and maintaining the status of "zombie" cache blocks.
[0031] The beneficial effects of this invention are:
[0032] This invention addresses the cache side-channel problem in existing TEEs, balancing security and performance requirements. It comprehensively considers the performance and storage needs of each layer of the cache system and takes into account the application scenarios of multi-core processors. It proposes a software-visible cache system that utilizes randomization and delayed cleanup mechanisms to further enhance the security of TEEs.
[0033] Overall, this invention provides TEE with more comprehensive, efficient, reliable, and flexible cache protection. In terms of security, this invention removes the direct association between physical addresses and cache group indexes through a cache group index randomization mechanism, significantly increasing the difficulty of constructing cache conflicts and mitigating access conflict-based attacks in principle. This invention also eliminates the latency difference before and after clearing instructions through a delayed clearing mechanism, fundamentally defending against attacks based on clearing instructions. This invention also considers the protection of cache modules at each level, defending against attacks from more diverse angles. In terms of performance, the method designed in this invention has low latency, does not restrict cache usage in security domains, and comprehensively analyzes and considers the performance characteristics of each cache level. It can be adjusted according to specific use cases and security performance requirements, and can also be combined with existing cache optimization techniques, thus generally resulting in minimal performance overhead. In terms of reliability, this invention extends the cache consistency protocol, ensuring the correctness of functionality after deployment. In terms of flexibility, some modules in this invention are software-visible. TEE software (such as a security monitor) can dynamically change the numbering of each security domain to dynamically and flexibly implement cache index remapping in accordance with the consistency protocol, avoiding the logical complexity and immutability of hardware implementation. Furthermore, this invention is applicable to systems with multi-core processors and has good scalability. The main hardware resource overhead of this invention is introduced by the encryption module, which is necessary to ensure security. The remaining mechanisms are lightweight designs, introducing only a small amount of logic and storage resources, and their impact on the CPU core area is negligible. Test and analysis results show that the security and performance of this invention are superior to the methods adopted by mainstream RISC-V platform TEEs, making it more suitable for real-world scenarios. Since this invention is a hardware architecture deployed on the on-chip system, its operational scope is not limited to the software running on the on-chip system; all the defense mechanisms described can be effective in any software operating environment. Attached Figure Description
[0034] Figure 1 This is a schematic diagram of the overall architecture of the caching system and security mechanisms;
[0035] Figure 2 This is a schematic diagram of the group index randomization mechanism based on security domains and hashing applied by the first-level cache module;
[0036] Figure 3 This is a schematic diagram of the group index randomization mechanism based on cryptographic computation applied by the second-level cache module;
[0037] Figure 2 and Figure 3 The application of the skew design in two types of cache modules is also illustrated.
[0038] Figure 4 This is a schematic diagram of the delayed eviction mechanism used by the caching system;
[0039] Figure 5 This is a schematic diagram illustrating the propagation of the delayed cleanup mechanism within the consistency domain;
[0040] Figure 6 This is a schematic diagram illustrating the consistency state maintenance related to the replacement operation under the delayed cleanup mechanism;
[0041] Figure 7 This is a schematic diagram of the extended TileLink cache consistency protocol. Detailed Implementation
[0042] The system model addressed in this invention comprises a system-on-a-chip (SoC) consisting of a RISC-V architecture CPU, cache system, and memory. The system needs to support a trusted execution environment, and the isolation mechanism implementation includes the concept of a security domain. Furthermore, this invention is also applicable to other similar systems. The overall architecture of this invention is described below with reference to the accompanying drawings.
[0043] This invention discloses a cache side-channel attack defense method based on a RISC-V architecture trusted execution environment. The overall architecture is as follows: Figure 1 As shown. In the caching system, all cache modules are set-associative and employ random replacement strategies and path skew techniques. This invention extends the TileLink bus protocol to support security functions. The first-level cache uses a set index randomization mechanism based on security domains and hashing, which is visible to the software. The second-level cache uses a set index randomization mechanism based on cryptographic computation. The system as a whole deploys a delayed purge mechanism, both of which are transparent to the software. The two set index randomization mechanisms are used to defend against attacks based on access conflicts, and the delayed purge mechanism is used to defend against attacks based on purge instructions. All three mechanisms work simultaneously. When the CPU accesses the first-level cache module, the module uses the set index randomization mechanism based on security domains and hashing to calculate the cache set index to access the data. When the first-level cache accesses the second-level cache, the two transmit signals through the TileLink bus. The second-level cache uses the set index randomization mechanism based on cryptographic computation to calculate the cache set index to access the data. When the CPU executes a cache block purge instruction, the delayed purge mechanism coordinates the first and second-level cache modules through the TileLink bus to jointly complete the secure purge operation.
[0044] In this invention, the first-level cache module uses a group index randomization mechanism based on security domains and hashing, which is as follows: Figure 2As shown. RISC-V platform TEEs typically use Physical Memory Protection (PMP) to implement memory isolation protection for security domains, performing permission checks before accessing memory or cache. A PMP consists of several PMP entries, and the TEE usually binds each security domain to a unique PMP entry; therefore, the PMP entry number is used as the identifier for the security domain. Assuming the cache module has w paths and the index has n bits, under path skew technology, each path is bound to a unique random number skew_offset. The index calculation process for the first-level cache module is as follows:
[0045] (1) The TLB outputs the matching PMP number, and the module converts the PMP number into a unique PMP key through a mapping table;
[0046] (2) Copy the physical address accessed by the processor into w copies;
[0047] (3) Circularly shift the above w physical addresses to the left by the corresponding skew_offset bits;
[0048] (4) XOR the above shift result with the PMP key, and then perform a round of xorshift operation;
[0049] (5) Extract n bits of signal from the lower bits at the offset of skew_offset in the obtained result, and use them as the group index of each channel.
[0050] In this invention, the second-level cache module uses a group index randomization mechanism based on cryptographic computation, which is as follows: Figure 3 As shown. This mechanism uses an adjustable block cipher to calculate the cache group index. Due to the use of path skew, a separate encryption module is deployed for each path, using different keys and handles. Assuming the second-level cache module has w paths and the index has n bits, the index calculation process is as follows:
[0051] (1) Clear the offset part of the accessed physical address and use it as plaintext input encryption module;
[0052] (2) Use the 20,000 random numbers generated during hardware instantiation as keys and handles to input into the encryption modules of each channel;
[0053] (3) Extract the lower n bits of the output ciphertext and use them as the cache group index.
[0054] The delayed clearing mechanism of the present invention is as follows: Figure 4 As shown, this mechanism introduces an additional "zombie" state for cache blocks. Specifically, the mechanism includes the following operations:
[0055] (1) When the processor executes the clear instruction, it completes the original operation and marks the cleared cache block as a "zombie" state;
[0056] (2) When the processor reads or clears the "zombie" cache block, it is determined to be a cache hit;
[0057] (3) When the processor writes to the "zombie" cache block, it is determined to be missing and a write permission is requested from the consistency maintenance module;
[0058] (4) When the consistency maintenance module probes the "zombie" cache block, it determines that a hit has been found, and the remaining operations remain unchanged;
[0059] (5) When a cache is replaced, a "zombie" cache block can be directly overwritten as an invalid cache block and is then truly cleared. Figure 5 This is a schematic diagram illustrating the propagation of the delayed cleanup mechanism within the consistency domain. The process mainly includes the following steps:
[0060] (1) When the clear instruction is executed, the consistency maintenance module (such as the directory structure of the last level cache) will pass the control signal to all cache modules that store the target cache block, namely the cache modules of core 1 (C1) and core 2 (C2) in the figure.
[0061] (2) Upon receiving the above control signal, the cache module marks the stored target cache block as a "zombie" state;
[0062] (3) The consistency maintenance module marks the copy of the target cache block as "shared" to ensure that other cache modules can read the correct data from the "zombie" cache block.
[0063] The replacement operation of "zombie" cache blocks is as follows: Figure 6 As shown, the process mainly includes the following steps:
[0064] (1) When a "zombie" cache block is replaced, there is no need to send a status update message to the consistency maintenance module;
[0065] (2) When the consistency maintenance module needs to update the status of the cache block, it first sends a probe message to the cache that may store the block;
[0066] (3) If a cache module receives a probe (assuming it is the cache module of core 1), it responds to the consistency maintenance module to indicate whether the block has been replaced;
[0067] (4) After receiving the response, if the consistency maintenance module knows that the target cache block has been replaced, it will directly update the status of the cache block; if it knows that the target cache block has not been replaced, it will first invalidate the copy of the cache block in core 1, and then update the status.
[0068] To ensure proper cache consistency maintenance after deploying the above mechanism, this invention extends the TileLink bus protocol, such as... Figure 7As shown. To maintain the consistency of the same cache block before and after security domain migration, this invention adds a Security Identifier (SID) field to the A and B channels of the protocol. The extended protocol mainly includes the following operations:
[0069] (1) The second-level cache module uses a directory structure to maintain consistency, which stores the identifier of the security domain in which each cache block was last accessed;
[0070] (2) When the first-level cache module accesses an address in a security domain for the first time, a missing information will occur. At this time, the identifier of the security domain (such as the PMP number mentioned above) will be included in the request message and sent to the second-level cache module through the A channel.
[0071] (3) If the security identifier in the request message of the first-level cache module is consistent with that stored in the directory structure, then the request will be responded to according to the original logic.
[0072] (4) If the security identifier in the request message of the first-level cache module is inconsistent, the second-level cache module first requests the cache module holding the block to release it through the B channel, updates the security identifier and data, and then responds to the request.
[0073] (5) When the second-level cache module requests other cache modules to release, it also needs to pass a security identifier so that the first-level cache module that receives the request can calculate the cache group index with the correct identifier.
[0074] To support the delayed cleanup mechanism, this invention extends the cleanup field (FLUSH) to the B and C channels of the protocol. When the first-level cache module performs a cleanup operation, it sets the cleanup flag of the C channel to 1. After receiving the message from the C channel, the second-level cache module sends a probe request carrying the cleanup flag to other cache modules holding the target cache block through the B channel. After receiving the request from the B channel, these cache modules use the delayed cleanup mechanism to clean up the target cache block.
[0075] It will be understood by those skilled in the art that the above description is merely a single example of the invention and is not intended to limit the invention. Although the invention has been described in detail with reference to the foregoing examples, those skilled in the art can still modify the technical solutions described in the foregoing examples or make equivalent substitutions for some of the technical features. All modifications and equivalent substitutions made within the spirit and principles of the invention should be included within the scope of protection of the invention.
Claims
1. A cache side-channel attack defense method based on a RISC-V architecture trusted execution environment, characterized in that, The defense method described herein is used for a system-on-a-chip consisting of a RISC-V architecture central processing unit, a cache system, and memory, wherein the cache system includes a first-level cache module and a second-level cache module; The first-level cache module uses a group index randomization mechanism based on security domains and hashing to defend against access collision-based attacks. The second-level cache module uses a group index randomization mechanism based on cryptographic computation to defend against access collision-based attacks. The two-level cache module employs a set-associative design and uses a random replacement strategy and a path skew design. A delayed clearing mechanism is used in the aforementioned caching system to defend against attacks based on clearing instructions; An extended TileLink bus protocol is used in the aforementioned caching system to maintain cache consistency; The first-level cache module is connected to the central processing unit, and the second-level cache module is connected to the first-level cache module through the TileLink bus, and is also connected to the memory through the TileLink bus. The group index randomization mechanism based on security domains and hashing first obtains the number of the current running security domain from the processor register and maps it to a unique key. Then, it performs a random shift operation on the part of the physical address accessed by the processor excluding the offset bit, XORs it with the aforementioned key, and performs an XOR shift operation. Finally, it truncates the result to the lower bits at the random offset as the group index of the first-level cache module. The random values of the random shift and the random offset are both taken from the aforementioned path skew random value.
2. The RISC-V architecture based trusted execution environment cache side-channel attack defense method of claim 1, wherein, The defense method includes three defense mechanisms, which work simultaneously to defend against corresponding attacks: When the central processing unit accesses the first-level cache module, the first-level cache module uses a group index randomization mechanism based on security domains and hashes to calculate the cache group index to access the data; When the first-level cache accesses the second-level cache, it transmits signals to the second-level cache through the TileLink bus. The second-level cache uses a group index randomization mechanism based on cryptographic calculation to calculate the cache group index to access the data. When the central processing unit executes a cache block clearing instruction, the delayed clearing mechanism coordinates the first and second level cache modules through the TileLink bus to jointly complete the safe clearing operation.
3. The cache side-channel attack defense method based on a RISC-V architecture trusted execution environment according to claim 1, characterized in that, In the aforementioned defense method, the first-level cache module is core-private of the central processing unit (CPU). In the case of a single-core CPU, the second-level cache module is core-private; in the case of a multi-core CPU, the second-level cache module is shared among the cores.
4. The cache side-channel attack defense method based on a RISC-V architecture trusted execution environment according to claim 1, characterized in that, The aforementioned path skew technique can be applied to the above-mentioned cache modules at all levels. In the first-level cache module, the group index randomization mechanism based on security domain and hashing binds a unique path skew random value to each path of the cache module. In the second-level cache module, the group index randomization mechanism based on encrypted computation deploys an encrypted module for each cache path, and inputs different keys and handle parameters to calculate the index for each path.
5. The cache side-channel attack defense method based on a RISC-V architecture trusted execution environment according to claim 1, characterized in that, The group index randomization mechanism based on cryptographic computation uses an adjustable block cipher. The plaintext input to the cryptographic computation is the part of the accessed physical address excluding the offset bit. The input key and the handle are unique values randomly generated during hardware instantiation. The low bits of the output ciphertext are truncated and used as the group index of the second-level cache.
6. The cache side-channel attack defense method based on a RISC-V architecture trusted execution environment according to claim 1, 2, 3, 4, or 5, characterized in that, The aforementioned delayed clearing mechanism marks the cache block cleared by the clearing instruction as a "zombie" state and executes other operations of the clearing instruction normally. When the "zombie" cache block is accessed again, the cache block is determined to be valid according to the specific access operation, thereby eliminating the time delay difference before and after the clearing instruction is executed.
7. The cache side-channel attack defense method based on a RISC-V architecture trusted execution environment according to claim 6, characterized in that, The TileLink protocol has been extended to support the three security mechanisms. Since addresses may migrate between different security domains, the group index randomization mechanism based on security domains and hashes will dynamically use different security domain numbers to calculate the cache index for the address. The consistency protocol transmits and maintains the security domain information of each cache block to ensure consistency before and after migration. Since the clearing instruction is directed to the entire defense method, the consistency protocol is responsible for propagating the control signal of the delayed clearing mechanism within the cache consistency domain. In addition, the consistency protocol is also responsible for tracking and maintaining the state of "zombie" cache blocks.