System and method for flush-reload cache side channel attack mitigation

Abstract

Embodiments of the present disclosure relate to systems and methods related to washout and reload cache side channel attack mitigation are described. An example method for mitigating side-channel timing attacks in a system including a processor having at least one cache is described. The method includes receiving a first instruction, wherein the first instruction, when executed by a processor, is configured to flush at least one cache line from at least one cache associated with the processor. The method further includes, prior to execution of the first instruction by the processor, automatically mapping the first instruction to the second instruction such that the at least one cache memory line is not flushed from the at least one cache even in response to receiving the first instruction.

Description

Background Art

[0001] Multiple users or tenants can share a system including a computing system and a communication system. The computing system can include a public cloud, a private cloud, or a hybrid cloud with both public and private parts. A public cloud includes a global network of servers that perform various functions, including storing and managing data, running applications, and delivering content or services, such as streaming video, supplying emails, providing office productivity software, or processing social media. Servers and other components can be located in data centers across the world. Although public clouds provide services to the public via the Internet, enterprises can use private clouds or hybrid clouds. Both private and hybrid clouds also include a network of servers housed in a data center.

[0002] Multiple tenants can use the computing, storage, and network resources associated with the servers in the cloud. Computing, storage, and network resources can be provided using a host operating system (OS) installed on a computing node (e.g., a server) in a data center. Each host OS can allow multiple computing entities such as virtual machines to access the computing and memory resources associated with the corresponding computing nodes. The memory pages maintained by the host OS can be shared between various computing entities (e.g., containers) supported by the host OS. This sharing of pages may cause the possibility of a side channel attack on the cache side channel between processes, such as a flush plus reload cache side channel attack. Therefore, it is necessary to mitigate such side channel attacks. System and method. Summary of the invention

[0003] In one example, the present disclosure relates to a method for mitigating side channel timing attacks in a system, the system including a processor having at least one cache. The method may include receiving a first instruction, wherein the first instruction, when executed by the processor, is configured to flush at least one cache line from at least one cache associated with the processor. The method may also include automatically mapping the first instruction to a second instruction before executing the first instruction by the processor, such that at least one cache line is not flushed from the at least one cache even in response to receiving the first instruction.

[0004] In another example, the present disclosure relates to a processor having at least one cache. The processor may include circuitry configured to receive a first instruction, wherein the first instruction, when executed by the processor, is configured to flush at least one cache line from at least one cache associated with the processor. The circuitry may also be configured to automatically map the first instruction to a second instruction before the first instruction is executed by the processor, such that at least one cache line is not flushed from the at least one cache even in response to receiving the first instruction.

[0005] In yet another example, the present disclosure relates to a method for mitigating side channel timing attacks in a system, the system comprising a processor having at least one cache. The method may include receiving a first instruction, wherein the first instruction, when executed by the processor, is configured to flush at least one cache line from at least one cache associated with the processor. The method may also include, before the processor executes the first instruction, a microcode unit associated with the processor automatically mapping the first instruction to a second instruction, such that at least one cache line is not flushed from the at least one cache even in response to receiving the first instruction, wherein automatically mapping the first instruction to the second instruction comprises applying a microcode patch to the processor.

[0006] This Summary is provided to introduce some concepts in a simplified form that are further described below. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The present disclosure is illustrated by way of example and not limitation in the accompanying drawings, in which like reference numerals represent similar elements. Elements in the drawings are illustrated for simplicity and clarity and are not necessarily drawn to scale.

[0008] Figure 1 is a block diagram of a system according to an example;

[0009] Figure 2 Shown with Figure 1 A block diagram of a processor associated with a system;

[0010] Figure 3 Shown included in Figure 2 An example implementation of a microcode unit in a processor of .

[0011] Figure 4 A data center for implementing flush-and-reload cache side-channel attack mitigation according to one example is shown;

[0012] Figure 5 A flow chart illustrating a method for implementing flush-and-reload cache side-channel attack mitigation according to one example; and

[0013] Figure 6 A flow chart of another example method for implementing flush-and-reload cache side-channel attack mitigation according to one example is shown. DETAILED DESCRIPTION

[0014] The examples described in this disclosure relate to systems and methods for mitigating flush-and-reload cache side-channel attacks. Certain examples are related to mitigating flush-and-reload cache side-channel attacks in computing systems or multi-tenant computing systems. The multi-tenant computing system can be a public cloud, a private cloud, or a hybrid cloud. A public cloud includes a global network of servers that perform various functions, including storing and managing data, running applications, and delivering content or services, such as streaming video, email, office productivity software, or social media. Servers and other components can be located in data centers across the world. Although public clouds provide services to the public via the Internet, enterprises can use private clouds or hybrid clouds. Both private clouds and hybrid clouds also include a network of servers housed in a data center. Computing entities can be executed using the computing and memory resources of a data center. As used herein, the term "computing entity" includes, but is not limited to, any executable code (in the form of hardware, firmware, software, or any combination of the foregoing) that implements functions, virtual machines, applications, services, microservices, containers, or single kernels for serverless computing. Alternatively, the computing entity may be executed on hardware associated with an edge computing device, a local server, or other types of systems, including communication systems such as base stations (e.g., 5G or 6G base stations).

[0015] Caches help mitigate the long delays associated with accessing main memory (e.g., double data rate (DDR) dynamic random access memory (DRAM)) by providing data with low latency. A processor may access a cache hierarchy including an L1 cache, an L2 cache, and an L3 cache, where the L1 cache may be closest to the processing core and the L3 cache may be farthest. Data access may be made to the cache memory first, and if the data is found in the cache, it is considered a hit. However, if the data is not found in the cache, it is considered a miss, and the data needs to be loaded from the main memory (e.g., DRAM). Unfortunately, the timing difference between cache hits and cache misses can be used by an adversary as a side channel to infer access patterns and obtain unauthorized information from the system. Such cache attacks have been shown to leak sensitive information, such as encryption keys or other credentials and secrets.

[0016] Figure 11 is a block diagram of a system 100 according to an example. Each system may include computing resources (e.g., processors) and memory resources (e.g., cache and system memory). As an example, system 100 may include computing nodes 110 and host operating systems 190 supported by computing nodes 110. Computing nodes 110 may include central processing units (CPUs) 120, which may include several processing cores and different cache levels. In this example, CPU 120 may include core 0 122, core 1 132, and core N 142, where N is an integer equal to the number of cores in the CPU, which in this example may be in the range of 3 to 256. Core 0 122 may have exclusive access to level 1 and level 2 caches (e.g., L1 cache 124 and L2 cache 126). Core 1 132 may have exclusive access to level 1 and level 2 caches (e.g., L1 cache 134 and L2 cache 136). Core N 142 may have exclusive access to level 1 and level 2 caches (e.g., L1 cache 144 and L2 cache 146). Each core in the core may also have access to a shared last level cache (LLC) 150, which may be considered a level 3 cache in the cache hierarchy. Figure 1 A certain hierarchy of caches is shown, but CPU 120 may include caches that are non-hierarchical and arranged differently.

[0017] Continue to refer Figure 1, CPU 120 may also include a system-level cache controller (e.g., SLCC 152) for managing transactions between cache and system memory. SLCC 152 may be coupled to memory controller 160 (e.g., DRAM controller) via bus 164. Memory controller 160 may be coupled to system memory 172 via bus 174. System memory 172 may be any combination of non-volatile memory or volatile memory (e.g., flash memory, DRAM, SRAM, or other types of memory). Bus system 180 may also couple CPU 120 and system memory 172 to other components of computing node 110, including data memory 182, sensors 184, and network interface 186. Sensors 184 may include telemetry or other types of sensors configured to detect and / or receive information (e.g., memory usage of various virtual machines executed by various computing nodes in a data center). Sensors 184 may also include sensors configured to sense conditions associated with CPUs, memory or other storage components, FPGAs, motherboards, baseboard management controllers, and the like. Network interface 186 may include a communication interface, such as Ethernet, cellular radio, Bluetooth radio, UWB radio, or other types of wireless or wired communication interfaces. In addition, although not shown, computing node 110 may also include I / O ports, such as Ethernet ports, fiber optic ports, wireless ports, or other communication or diagnostic ports. Figure 1 Each computing node shown in FIG. 1 has a single CPU, but each computing node may include additional CPUs and other devices, such as a graphics processor unit (GPU), a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), or other devices. In addition, each computing node 110 may have a system memory 172 organized as a memory module. Examples of such memory modules include, but are not limited to, dual in-line memory modules (DIMMs) or single in-line memory modules (SIMMs). The memory included in these modules may be dynamic random access memory (DRAM), flash memory, static random access memory (SRAM), phase change memory, magnetic random access memory, or any other type of memory technology.

[0018] Still reference Figure 1, each computing node 110 can be configured to execute several computing entities. In this example, the host OS 190 can support several containers (e.g., container 1 192, container 2 194, and container M 196, where M is a positive integer). In this example, the container can be a lightweight virtual interface module that can share the host OS 190 to support other applications. In this way, these containers can share a considerable percentage of the code base, including shared libraries, making the container vulnerable to side channel attacks through caches associated with the CPU that executes the shared library. Other computing entities that share libraries or other code may be similarly vulnerable to similar side channel attacks.

[0019] In one example, the computing nodes 110 may be part of a data center. As used in this disclosure, the term data center may include, but is not limited to, some or all of the data centers owned by a cloud service provider, some or all of the data centers owned and operated by a cloud service provider, some or all of the data centers owned by a cloud service provider that are operated by customers of the service provider, any other combination of data centers, a single data center, or even some clusters within a particular data center. In one example, each cluster may include several identical computing nodes. Thus, a cluster may include a computing node that includes a specific number of CPU cores and a specific amount of memory. Other types of hardware may also be used in place of computing nodes, such as edge computing devices, local servers, or other types of systems, including communication systems, such as base stations (e.g., 5G or 6G base stations). Although Figure 1 System 100 is shown as having a certain number of components, including compute nodes and memory components, arranged in a certain manner, but system 100 may include additional or fewer components arranged differently.

[0020] As mentioned previously, the timing difference between cache hits and cache misses can be used as a side channel by an attacker to infer access patterns and obtain unauthorized information from the system. Such cache attacks have been shown to leak sensitive information such as encryption keys or other credentials and secrets. One such attack is known as a flush-and-reload attack. Figure 1 , assuming that attacker A is accessing Figure 1 The computing node 110 of the victim V is also accessing Figure 1 The example also assumes that the attacker A and the victim V are mapped to the nodes stored in Figure 1 As part of faster access to the shared library, the executable code corresponding to the shared library may be stored in a directory associated with the system memory 172 (e.g., a cryptographic library for performing AES cryptographic functions). Figure 1 The cache hierarchy associated with the CPU 120 of the compute node 110 is shown in FIG. 1 . As part of the flush-and-reload attack, once the shared library has been cached, attacker A flushes the shared library from the cache to the system memory. As an example, for an x86-based CPU, the flush operation can be accomplished by using the CLFLUSH instruction, which can be executed in user mode. The CLFLUSH instruction flushes a given cache line from all cache hierarchies (e.g., L1 cache, L2 cache, and last level cache (LLC)) and writes any dirty data back to the system memory. Using the CLFLUSH instruction, the attacker can mount a timing attack on the victim.

[0021] Next, after flushing the cache, attacker A waits for a sampling interval (e.g., one microsecond, one millisecond, or some other appropriate amount of time for a certain CPU). After the sampling interval expires, attacker A reloads the shared library. If the reload operation takes a short amount of time, attacker A knows that victim V has accessed the shared library from memory. As part of victim V's access, the cache controller loads the shared library into the associated cache. Alternatively, if the reload operation takes a longer amount of time, attacker A knows that victim V did not access the shared library during the sampling interval. Attacker A can then reload the shared library, flush it again, wait for the sampling interval, and decrypt whether victim V has accessed the shared library. By repeatedly flushing and reloading the shared library, attacker A can access a sample graph that changes over time, and can use these samples to discern patterns. The pattern can provide attacker A with enough information over time to determine that the cryptographic key victim V is using. Existing solutions to flush and reload attacks are poor for several reasons. For example, one solution involves tracking zombie cache lines. However, this solution is an invasive and complex implementation. For example, this solution requires changes to the CPU hardware, so it cannot be used with existing CPUs. In addition, tracking of zombie cache lines not only affects the performance of the CPU, but also uses up the storage associated with the CPU.

[0022] To address the flush-and-reload attack, a solution is described that involves using a microcode patch to autonomously map all cache flush instructions (e.g., CLFLUSH instructions) to cache write-back instructions (e.g., CLWB instructions). Similar to the CLFLUSH instruction, the CLWB instruction writes dirty data back to memory. However, unlike the CLFLUSH instruction, the CLWB instruction retains any unmodified copies of the lines in the cache hierarchy. As a result, the attacker (e.g., attacker A described previously) can no longer affect the access timing of the victim (e.g., victim V described previously), thereby defeating the flush-and-reload attack.

[0023] Figure 2 A diagram of a processor 200 is shown that may include functionality to remap a CLFLUSH instruction to a CLWB instruction. Processor 200 may be any Complex Instruction Set Computer (CISC) ISA-compatible CPU or another type of processor. Processor 200 includes a fetch unit 210, an instruction cache 220, a microcode unit 230, a decode unit 240, and an execution unit 250. Additional aspects of processor 200 are not shown, including branch prediction logic, reordering logic, and issue logic. Fetch unit 210 fetches instructions (e.g., using addresses provided by branch prediction logic (not shown)) and stores the read instructions in instruction cache 220. The instructions are then provided to microcode unit 230, which converts the fetched instructions (e.g., CLFLUSH instructions) into microinstructions. The microcode patch may be uploaded to a CPU (e.g., BIOS or UEFI) during a boot process by firmware associated with the CPU (e.g., BIOS or UEFI). Figure 1 CPU120). After uploading, the microcode patch can be stored in a microcode patch RAM associated with the microcode unit 230.

[0024] A microcode patch may contain a plurality of microinstructions corresponding to any instruction being patched (eg, a CLFLUSH instruction). Figure 3 As explained, when the microcode unit 230 encounters a CLFLUSH instruction, a microinstruction for the CLFLUSH instruction is obtained from the microcode patch RAM. In one example, even when the microcode unit 310 encounters a CLFLUSH instruction, the microcode instruction in the microcode patch RAM corresponds to a CLWB instruction. This in turn causes the CLFLUSH instruction to be remapped to a CLWB instruction. Using similar logic, any other cache flush instruction similar to the CLFLUSH instruction can be remapped to a cache write-back instruction similar to the CLWB instruction. The microinstruction is then decoded by the decode unit 240, and a cache write-back operation is performed instead of a cache flush operation. This results in mitigating the flush plus reload technique described above. Although Figure 2 Processor 200 is shown as including certain components arranged in a certain manner, but processor 200 may include additional or fewer components arranged differently. Figure 2 The mitigation of the flush heavy load technique is described for the CLFLUSH instruction, but any other cache flush instruction may be handled in an equivalent manner to mitigate the flush heavy load side channel attack.

[0025] Figure 3 Shown included in Figure 2An example implementation of a microcode unit 300 in a processor 200 of FIG. 300 (eg, corresponding to Figure 2 The microcode unit 230 of the embodiment of the present invention may include the logic, registers, and other components required to remap a cache line instruction (e.g., a CLFLUSH instruction) to a cache write back instruction (e.g., a CLWB instruction). In this example, the microcode unit 300 may include a microcode unit input stage 310, a sequencer 320, a next address register 330, a match register 340, a comparator 350, a lookup table 360, a multiplexer 370, a microcode read-only memory (ROM) 380, and a microcode patch random access memory (RAM) 390. As previously described, a microcode patch for remapping the CLFLUSH instruction to a microinstruction corresponding to the CLWB instruction may be loaded into the microcode patch RAM 390. The microcode input unit stage 310 may calculate the microcode corresponding to the microinstruction corresponding to the CLWB instruction. Figure 2 The address of the first microinstruction corresponding to the instruction received by the instruction cache 220 (for example, the address of the microinstruction stored in the microcode ROM 380 or the microcode RAM 390).

[0026] Continue to refer Figure 3 , instructions (e.g., CLFLUSH instructions) may need to decode the microinstruction set before being decoded. Sequencer 320 controls multiplexer 370 to provide the correct next address to next address register 330. Sequencer 320 can be implemented using a finite state machine or other logic. Sequencer 320 ensures that all microinstructions corresponding to instructions are processed sequentially. The address stored in next address register 330 is provided to comparator 350. Comparator 350 compares the address provided by next address register 330 with the address stored in matching register 340. If there is a match between the address and any address stored in matching register 340, a patch from microcode patch RAM 390 is implemented. In this example, when there is a match, a signal from comparator 350 is used to select an address from lookup table 360 ​​for microcode patch RAM 390. Lookup table 360 ​​can be implemented as a programmable logic array or use other logic. Sequencer 320 controls multiplexer 370 to feed the lookup address from lookup table 360 ​​for further processing. As a result, instead of the microinstructions located in microcode ROM 380, the microinstructions located in microcode patch RAM 390 are provided to the decoder (e.g., Figure 2 Thus, in this example, the match register 340 includes an entry that allows the microinstruction corresponding to the CLWB instruction to be provided from the microcode patch RAM 390 when the CLFLUSH instruction is processed. This in turn results in a mapping of the CLFLUSH instruction to the CLWB instruction. Figure 3The microcode unit 300 is shown as having a certain number of components arranged in a certain manner, but the microcode unit 300 may include additional or fewer components arranged differently. Figure 3 The mitigation of the flush heavy load technique is described with respect to the CLFLUSH instruction, but any other cache flush instruction may also be handled in an equivalent manner to mitigate the flush heavy load side channel attack.

[0027] Among other advantages, the example solution described herein is compatible with existing x86 processors and related functions. The CLFLUSH instruction is designed primarily for non-coherent direct memory access (DMA) devices (e.g., peripheral component interconnect express (PCIe) devices) that can be directly written to system memory. In such an environment, if the application wants to read the latest data, it will first execute the CLFLUSH instruction, allowing the non-coherent DMA device to write the data to the system memory, and then perform a load operation. This load instruction will cause a cache miss, and the latest data will be obtained from the system memory (e.g., DRAM). However, over time, modern CPUs (e.g., Intel and AMD CPUs) have implemented coherent DMA. This means that when a non-coherent DMA device updates data (e.g., data in the form of a cache row), it is updated not only in the system memory but also in any associated CPU cache. Advantageously, this automatic update eliminates the need to use the CLFLUSH instruction.

[0028] In addition, even if the CLFLUSH instruction exists in the legacy code, the automatic update makes it safe to remap the CLFLUSH instruction to the CLWB instruction. The CLFLUSH instruction can also be used to checkpoint the contents of volatile memory and flush them to persistent memory (e.g., flash memory). However, because the CLWB instruction flushes any dirty cache lines to system memory (e.g., DRAM), the use of the CLWB instruction (rather than the CLFLUSH instruction) does not cause any problems.

[0029] Figure 4 A data center 400 for implementing flush-load cache side channel attack mitigation is shown according to one example. As an example, the data center 400 may include several rack clusters, the rack clusters including platform hardware, such as computing resources, storage resources, network resources, or other types of resources. The computing resources may be provided by computing nodes provided via servers, and the servers may be connected to switches to form a network. The network may enable connections between every possible combination of switches. The data center 400 may include server 1 410 and server N 430, each of which may use the same method as previously described for the attack. Figure 1414. The data center 400 may also include data center related functions 460, including deployment / monitoring 470, directory / identity server 472, load balancing 474, data center controller 476 (e.g., software defined network (SDN) controller and other controllers), and router / switch 478. Server 1 410 may include (multiple) CPUs 411, host hypervisor 412, memory 413, (multiple) storage interface controllers ((multiple) SICs) 414, cooling 415, (multiple) network interface controllers ((multiple) NICs) 416, and storage disks 417 and 418. Server 430 may include (multiple) CPUs 431, host hypervisor 432, memory 433, (multiple) storage interface controllers ((multiple) SICs) 434, cooling 435, (multiple) network interface controllers ((multiple) NICs) 436, and storage disks 437 and 438. Server 1 410 may be configured to support virtual machines (or containers), including VM1 419, VM2 420, and VMN 421. The virtual machines may also be configured to support applications such as APP1 422, APP2 423, and APPN 424. Server 430 may be configured to support virtual machines (or containers), including VM1 439, VM2 440, and VMN 441. The virtual machines may also be configured to support applications such as APP1 442, APP2 443, and APPN 444. Each of host hypervisors 412 and 432 may reference a shared library that may be used to support any computing entity, including the previously described Figure 1 Description of the container.

[0030] Continue to refer Figure 4 In one example, data center 400 can use a virtual extensible local area network (VXLAN) framework to enable multiple tenants. Each virtual machine (VM) can be allowed to communicate with VMs in the same VXLAN segment. Each VXLAN segment can be identified by a VXLAN network identifier (VNI). Although Figure 4 Data center 400 is shown as including a certain number of components arranged and coupled in a certain manner, but it may include fewer or additional components arranged and coupled in a different manner. Furthermore, the functionality associated with data center 800 may be distributed or combined as desired.

[0031] Figure 5 A flowchart 500 of an example method for mitigating side channel timing attacks in a system including a processor having at least one cache is shown. In one example, the steps associated with the method may be performed by various components of the previously described system (e.g., Figure 1 System 100 and Figure 2 Step 510 may include receiving a first instruction, wherein the first instruction, when executed by the processor, is configured to flush at least one cache line from at least one cache associated with the processor. For example, the step may include receiving a CLFLUSH instruction as the first instruction. As previously described, an attacker may use a flush-and-reload attack to steal another user's information from a cache associated with a processor.

[0032] Step 520 may include, before the processor executes the first instruction, automatically mapping the first instruction to a second instruction such that at least one cache line is not flushed from at least one cache even in response to receiving the first instruction. As an example, the step may include receiving a CLFLUSH instruction as the first instruction, and automatically mapping the CLFLUSH instruction to a second instruction (e.g., a CLWB instruction). As previously described, a microcode patch may be applied to the processor by loading the microcode patch at startup. The microcode patch itself may be loaded from a flush associated with a computing system that includes the processor. Additional details regarding one manner of applying the patch are provided above with reference to Figure 3 supply.

[0033] Figure 6 A flowchart 600 is shown for an example method for mitigating side channel timing attacks in a system including a processor having at least one cache. In one example, the steps associated with the method may be performed by various components of the previously described system (e.g., Figure 1 System 100 and Figure 2 Step 610 may include receiving a first instruction, wherein the first instruction, when executed by the processor, is configured to flush at least one cache line from at least one cache associated with the processor. For example, the step may include receiving a CLFLUSH instruction as the first instruction. As previously described, an attacker may use a flush-and-reload attack to steal another user's information from a cache associated with a processor.

[0034] Step 620 may include, before the processor executes the first instruction, a microcode unit associated with the processor automatically mapping the first instruction to a second instruction such that at least one cache line is not flushed from at least one cache even in response to receiving the first instruction, wherein automatically mapping the first instruction to the second instruction includes applying a microcode patch to the processor. As an example, the step may include receiving a CLFLUSH instruction as the first instruction and a microcode unit (e.g., a CLFLUSH instruction) automatically mapping the CLFLUSH instruction to a second instruction (e.g., a CLWB instruction). Figure 2As previously described, a microcode patch may be applied to a processor by loading the microcode patch at boot time. The microcode patch itself may be loaded from a flash associated with a computing system including the processor. Additional details on one way to apply the patch are provided above with reference to Figure 3 supply.

[0035] In summary, the present disclosure relates to a method for mitigating side channel timing attacks in a system, the system including a processor having at least one cache. The method may include receiving a first instruction, wherein the first instruction, when executed by the processor, is configured to flush at least one cache line from a cache associated with the processor. The method may also include: before the first instruction is executed by the processor, automatically mapping the first instruction to a second instruction, such that at least one cache line is not flushed from the at least one cache even in response to receiving the first instruction.

[0036] The processor may include a microcode unit. Automatically mapping the first instruction to the second instruction may include: the microcode unit applying a microcode patch to the processor. The first instruction may include a cache flush instruction, and the second instruction may include a cache write back instruction.

[0037] The microcode patch may include a microinstruction for a cache write back instruction such that applying the microcode patch to the processor causes the microinstruction for the cache write back instruction to be processed by the processor instead of the microinstruction for the cache flush instruction. The at least one cache may include a hierarchical arrangement of caches, and when each of the cache flush instruction and the cache write back instruction is executed, a dirty cache line may be written back to a memory associated with the processor, but unlike the cache flush instruction, the cache write back instruction may retain any unmodified copies of the cache line in the hierarchical arrangement of caches. The side channel timing attack may include a flush plus reload attack.

[0038] In another example, the present disclosure relates to a processor having at least one cache. The processor may include circuitry configured to receive a first instruction, wherein the first instruction, when executed by the processor, is configured to flush at least one cache line from at least one cache associated with the processor. The circuitry may also be configured to automatically map the first instruction to a second instruction before the first instruction is executed by the processor, such that at least one cache line is not flushed from the at least one cache even in response to receiving the first instruction.

[0039] The circuit may include a microcode unit. The circuit may be configured to automatically map a first instruction to a second instruction by applying a microcode patch to the processor. The first instruction may include a cache flush instruction, and the second instruction may include a cache write back instruction.

[0040] The microcode patch may include a microinstruction for a cache write back instruction such that application of the microcode patch to the processor causes the microinstruction for the cache write back instruction to be processed by the processor instead of the microinstruction for the cache flush instruction. The at least one cache may include a hierarchical arrangement of caches, and when each of the cache flush instruction and the cache write back instruction is executed, a dirty cache line may be written back to a memory associated with the processor, but unlike the cache flush instruction, the cache write back instruction may retain any unmodified copies of the cache line in the cache hierarchical arrangement. The side channel timing attack may include a flush plus reload attack.

[0041] In yet another example, the present disclosure relates to a method for mitigating side channel timing attacks in a system, the system comprising a processor having at least one cache. The method may include receiving a first instruction, wherein the first instruction, when executed by the processor, is configured to flush at least one cache line from at least one cache associated with the processor. The method may also include, before the processor executes the first instruction, a microcode unit associated with the processor automatically mapping the first instruction to a second instruction, such that at least one cache line is not flushed from at least one cache even in response to receiving the first instruction, wherein automatically mapping the first instruction to the second instruction comprises: applying a microcode patch to the processor.

[0042] The first instruction may include a cache flush instruction, and the second instruction may include a cache write back instruction. The microcode patch may include a microinstruction for a cache write back instruction, such that application of the microcode patch to the processor causes the microinstruction for the cache write back instruction to be processed by the processor instead of the microinstruction for the cache flush instruction.

[0043] At least one cache may include a hierarchical arrangement of caches, and when each of a cache flush instruction and a cache write back instruction is executed, a dirty cache line is written back to a memory associated with the processor, but unlike the cache flush instruction, the cache write back instruction preserves any unmodified copies of the cache line in the cache hierarchical arrangement. The side channel timing attack may include a flush plus reload attack.

[0044] It should be understood that the methods, modules and components described herein are merely exemplary. Alternatively or additionally, the functions described herein may be performed at least in part by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that may be used include field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chip systems (SOCs), complex programmable logic devices (CPLDs), etc. In an abstract but still clear sense, any arrangement of components that implement the same function is effectively "associated" so that the desired function is achieved. Therefore, any two components that are combined to implement a specific function herein may be considered to be "associated" with each other so that the desired function is achieved, and are independent of the architecture or intermediate components. Similarly, any two components so associated may also be considered to be "operably connected" or "coupled" to each other to achieve the desired function. Just because a component that may be any other implementation of a device, structure, system or function is described herein as being coupled to another component does not mean that these components must be separate components. As an example, a component A described as being coupled to another component B may be a subcomponent of component B, component B may be a subcomponent of component A, or components A and B may be a combined subcomponent of another component C.

[0045] Functionality associated with some of the examples described in this disclosure may also include instructions stored in non-transitory media. The term "non-transitory media" used herein refers to any medium that stores data and / or instructions that cause a machine to operate in a particular manner. Exemplary non-transitory media include non-volatile media and / or volatile media. Non-volatile media include, for example, hard disks, solid-state drives, magnetic disks or tapes, optical disks or tapes, flash memory, EPROM, NVRAM, PRAM, or other such media, or networked versions of such media. Volatile media include, for example, dynamic memory, such as DRAM, SRAM, cache, or other such media. Non-transitory media are different from transmission media, but can be used in conjunction with transmission media. Transmission media, used to transmit data and / or instructions to or from a machine. Exemplary transmission media include coaxial cables, optical cables, copper wires, and wireless media, such as radio waves.

[0046] In addition, those skilled in the art will recognize that the boundaries between the functions of the above-mentioned operations are merely illustrative. The functions of multiple operations can be combined into a single operation, and / or the functions of a single operation can be distributed in additional operations. In addition, alternative embodiments can include multiple examples of specific operations, and the order of operations can be changed in various other embodiments.

[0047] Although the present disclosure provides specific examples, various modifications and changes may be made without departing from the scope of the present disclosure as set forth in the following claims. Therefore, the specification and drawings are to be regarded as illustrative rather than restrictive, and all such modifications are intended to be included within the scope of the present disclosure. Any benefits, advantages, or solutions to problems described herein with respect to specific examples are not intended to be construed as key, required, or essential features or elements of any or all of the claims.

[0048] In addition, the terms "a" or "an" as used herein are defined as one or more. Moreover, the use of introductory phrases such as "at least one" and "one or more" in the claims should not be construed as implying the introduction of another claim element by the indefinite article "a" or "an" to limit any particular claim including such introduced claim element to an invention containing only one such element, even if the same claim includes the introductory phrases "one or more" or "at least one" and an indefinite article such as "a" and "an". The same is true when using definite articles.

[0049] Unless otherwise stated, terms such as "first" and "second" are used to arbitrarily distinguish between the elements these terms describe. Therefore, these terms are not necessarily intended to indicate temporal or other prioritization of these elements.

Claims

1. A method for mitigating side-channel timing attacks in a system, the system comprising a processor having at least one cache, the method comprising: receiving a first instruction, wherein the first instruction, when executed by the processor, is configured to flush at least one cache line from the at least one cache associated with the processor; as well as Prior to execution of the first instruction by the processor, the first instruction is automatically mapped to a second instruction such that the at least one cache line is not flushed from the at least one cache even in response to receiving the first instruction.

2. The method of claim 1, wherein the processor comprises a microcode unit.

3. The method of claim 2, wherein automatically mapping the first instruction to the second instruction comprises: The microcode unit applies a microcode patch to the processor.

4. The method of claim 1, wherein the first instruction comprises a cache flush instruction and the second instruction comprises a cache write back instruction.

5. The method of claim 4 , wherein the microcode patch includes microinstructions for the cache write back instructions, such that applying the microcode patch to the processor causes the microinstructions for the cache write back instructions to be processed by the processor instead of the microinstructions for the cache flush instructions.

6. The method of claim 5 wherein the at least one cache comprises a hierarchical arrangement of caches, and wherein when each of the cache flush instruction and the cache write back instruction is executed, dirty cache lines are written back to a memory associated with the processor, but unlike the cache flush instruction, the cache write back instruction preserves any unmodified copies of cache lines in the hierarchical arrangement of caches.

7. The method of claim 1, wherein the side channel timing attack comprises: Flush plus reload attack.

8. A processor having at least one cache, the processor comprising: The circuit is configured as: receiving a first instruction, wherein the first instruction, when executed by the processor, is configured to flush at least one cache line from the at least one cache associated with the processor, and Prior to execution of the first instruction by the processor, the first instruction is automatically mapped to a second instruction such that the at least one cache line is not flushed from the at least one cache even in response to receiving the first instruction.

9. The processor of claim 8, wherein the circuit comprises a microcode unit.

10. The processor of claim 8, wherein the circuit is configured to automatically map the first instruction to the second instruction by applying a microcode patch to the processor.

11. The processor of claim 8, wherein the first instruction comprises a cache flush instruction and the second instruction comprises a cache write back instruction.

12. The processor of claim 11, wherein the microcode patch includes microinstructions for the cache write back instructions, such that applying the microcode patch to the processor causes the microinstructions for the cache write back instructions to be processed by the processor instead of the microinstructions for the cache flush instructions.

13. The processor of claim 12, wherein the at least one cache comprises a hierarchical arrangement of caches, and wherein when each of the cache flush instruction and the cache write back instruction is executed, dirty cache lines are written back to a memory associated with the processor, but unlike the cache flush instruction, the cache write back instruction preserves any unmodified copies of cache lines in the hierarchical arrangement of caches.

14. The processor of claim 8, wherein the side-channel timing attack comprises a flush-and-reload attack.

15. A method for mitigating side-channel timing attacks in a system comprising a processor having at least one cache, the method comprising: receiving a first instruction, wherein the first instruction, when executed by the processor, is configured to flush at least one cache line from the at least one cache associated with the processor; as well as Before the first instruction is executed by the processor, a microcode unit associated with the processor automatically maps the first instruction to the second instruction so that even in response to receiving the first instruction, the at least one cache line is not flushed from the at least one cache, wherein automatically mapping the first instruction to the second instruction includes: applying a microcode patch to the processor.

Images