Method for managing a cache memory

Description

[0001] The invention relates to a method and a unit for managing a cache memory of an electronic computer.

[0002] Caches are used so that a process executed by a microprocessor can more quickly access information originally stored in main memory.

[0003] In this application, "process" means both a program and a routine of this program or any other software executed by the computer and capable of reading or writing in the cache memory.

[0004] The state of the cache memory depends heavily on the addresses that have been accessed by the process(es) running on the ECU. Furthermore, the state of the cache memory at a given time can be observed quite easily by a third-party process running on the ECU or simply by measuring the access times to the cache memory.

[0005] These characteristics of a cache memory have been exploited to develop attacks known as "side channel attacks." These attacks make it possible to reveal secret information processed by an executed process or to modify the operation of the executed process to bypass security measures. For example, secret information is a cryptographic key used to encrypt or decrypt information. A security measure is, for example, entering a PIN.

[0006] To achieve this, side-channel attacks observe the state of the cache memory while the attacked process is running to determine the address(es) accessed by the attacked process. The accessed addresses depend on secret data processed by the attacked process. Thus, knowing the addresses accessed by the attacked process allows one to obtain information about this secret data. In general, these attacks assume the execution of an attacking process in parallel with the attacked process. This attacking process must be able to access specific addresses in the cache memory. This is particularly the case for the attack known as "Prime & Probe".

[0007] To increase the robustness of the cache memory against these attacks, it has been proposed to randomly scatter the cache lines accessed by a process. This is known as "spatial randomization".

[0008] One such particularly effective spatial randomization solution is described in the following article: M. Werner, T. Unterluggauer, L. Giner, M. Schwarz, D. Gruss, and S. Mangard, “SCATTERCACHE: Thwarting Cache Attacks via Cache Set Randomization,” USENIX Security Symposium, 2019, pages 675-692. Hereinafter, this solution is referred to as “Scattercache.”

[0009] More precisely, this article teaches that when a first process tries to read a word at an address @r, it transmits a request to the cache memory. This request contains the address @r. The address @r contains an address @Si,r of a set S i,r of lines of the cache memory likely to contain the searched word. This address @Si,r is often referred to by the English terms of "set" or "index". In the Scattercache solution, the address @Si,r is transmitted to a cryptographic function IDF which constructs, notably from the address @Si,r, the values of W line index Iw 1 to Iw W , where W is an integer greater than one. Each index Iw j points to a respective array W j , where the index j is an identifier of the array W j . The index j is here an integer between 1 and W. These arrays W j are better known by the English term "Way". Each array W j contains s distinct lines of the cache memory.The arrays W j are distinct from each other, that is, they have no rows in common. The value of the index Iw j uniquely identifies a row of the array W j . The set S i,r is only composed of the W rows identified by the values of the W indexes Iw j constructed by the IDF function.

[0010] If the searched word is not found in this set S i,r of lines, then this causes a cache miss. In case of a cache miss, a set of new lines containing the searched word is loaded into the cache memory from the main memory of the electronic calculator. The newly loaded lines are stored in place of the previous lines in the set S i,r .

[0011] Due to the organization in distinct tables and thanks to the use of different indexes Iw j to point to each table W j , the lines of the set S i,r are not located next to each other in the cache memory and are not located at the same location in each of the tables W j . This allows for much greater spatial randomization. Thus, the observation of the state of the cache memory, and in particular of the set S i,r , by an attacking process is more difficult.

[0012] In addition, the cryptographic function IDF is parameterized by a secret key k that can be modified. This key k is managed by a hardware module of the computer, which guarantees its confidentiality. However, in practice, it is not possible to modify the key k during the execution of a process. Indeed, after the modification of the key k, for the same address @ Si,r received, the values constructed for each of the indexes Iw j are different from those constructed for this same address @ Si,r and for the same process before the modification of the key k. In other words, after the modification of the key k, the address @ Si,r corresponds to a new set S' i,r of lines and no longer to the set S i,r . Therefore, during the first access to the set S' i,r after the modification of the key k, the word that the process wishes to access is not in this set S' i,r which systematically causes a cache miss.Furthermore, this cache miss occurs systematically for all executed processes and for all possible @S i,r addresses. Thus, changing the key k during the execution of a process triggers a very large number of cache misses, which substantially slows down the execution of processes. To avoid this problem, the Scattercache solution proposes changing the key k only when the computer is powered on.

[0013] In the Scattercache solution, the values of the indexes Iw j are also calculated using an SDID. Unlike key k, the SDID is managed by a software module. Thus, the security of this SDID is lower than that of key k. Moreover, similar to what was explained in the case of a modification of key k, a modification of the SDID triggers a large number of cache misses. Therefore, as for key k, in practice, the SDID cannot be modified frequently.

[0014] Due to the above limitations of the Scattercache solution, with this solution the spatial randomization is static or nearly static during the execution of a process. Therefore, an attacking process can still identify the cache lines used by an attacked process.

[0015] The invention aims to propose a method for managing the cache memory of an electronic computer that is more robust than the Scattercache solution.

[0016] The invention is set forth in the attached set of claims.

[0017] The invention will be better understood upon reading the following description, given solely as a non-limiting example and with reference to the drawings in which: there Figure 1 is a schematic illustration of the architecture of an electronic computer equipped with a cache memory; the Figure 2 is a schematic illustration of a cache memory management unit of the computer of the Figure 1 ; there Figure 3 is a schematic illustration of the structure of an indirection table used by the management unit of the Figure 2 ; there Figure 4 is a schematic illustration of the architecture of a cryptographic circuit implemented in the management unit of the Figure 2; there Figure 5 is a flowchart of a method for managing the cache memory of the computer of the Figure 1 .

[0018] In these figures, the same references are used to designate the same elements. In the remainder of this description, the characteristics and functions well known to those skilled in the art are not described in detail.

[0019] In this description, detailed examples of embodiments are first described in a chapter I with reference to the figures. Then, in a chapter II, variants of these embodiments are introduced. Finally, the advantages of the different embodiments are specified in a chapter III. Chapter I: Example of embodiment

[0020] There Figure 1schematically represents the architecture of an electronic computer 2. This computer 2 is typically integrated into a larger system 3 of which it controls and commands at least part of the operation. The system 3 is for example a computer, a mobile phone, a smartphone or any other electronic device whose operation is controlled, at least in part, by the computer 2.

[0021] Typically, calculator 2 includes: at least one microprocessor 4, a cache memory 6, a main memory 8, a mass memory 10, and information transmission buses 12 which connect these different elements of the computer 2 together.

[0022] The cache memory 6 is typically faster than the main memory 8, which is itself faster than the mass memory 10. The speed of a memory corresponds to the access time required to access information stored in this memory. Currently, typically, the access time of a cache memory is less than 30 ns or 20 ns and, generally, greater than 1 ns. The access time to a main memory is today typically less than 500 ns or 100 ns and, generally, greater than 30 ns or 50 ns. The access time to a mass memory is today typically greater than 1 µs or 10 µs and, generally, less than 10 ms.

[0023] Typically, the size of a memory of the computer 2 is smaller the faster this memory is. Thus, the size of the cache memory 6 is smaller than the size of the main memory 8 which is itself smaller than the size of the mass memory 10. The size of a memory is expressed in bytes. The size of the cache memory 6 is, for example, less than 4 MB and usually greater than 60 KB. The size of the main memory 8 is usually greater than 256 MB or 1 GB and, generally, less than or equal to 16 GB or 32 GB. The size of the mass memory 10 is usually greater than 4 GB or 1 TB.

[0024] Here, the memories of the computer 2 are classified by increasing access time. Thus, subsequently, the expression "higher-ranking memory" designates a memory whose access time is greater than the current memory.

[0025] Generally, memories 6 and 8 are volatile random access memories. For example, memory 6 is an SRAM (Static Random Access Memory) type memory. Main memory 8 is, for example, a DRAM (Dynamic Random Access Memory) type memory.

[0026] Mass storage 10 is generally non-volatile memory. Many different technologies exist for implementing such mass storage. For example, memory 10 may be magnetic tape, a hard disk, an optical disk such as a CD, DVD, or blue-ray disc, a magnetooptical disk, flash memory, a solid-state drive (SSD), or others.

[0027] The memory 10 contains, for example, a backup copy of the binary code of the processes to be executed by the microprocessor 4. The memory 10 may also contain copies of the data to be processed by the various processes that may be executed by the microprocessor 4. Typically, the binary code of the processes and the data to be processed are, for example, loaded into the memory 8 from the memory 10 when the computer 2 is powered up and / or in response to a reset command from the computer 2 or when the execution of a new process by the computer 2 is triggered.

[0028] The memory 6 may be a memory external to the microprocessor 4 as shown in the Figure 1 In this case, the memory 6 is, for example, produced on a substrate mechanically separated from the substrate on which the different elements of the microprocessor 4 are produced.

[0029] To simplify the description, it is considered here that the memory 6 comprises a single cache memory level, that is to say typically the level known under the expression “L1 cache”. However, everything that is described subsequently in this particular case can be easily transposed by those skilled in the art to the case of cache memories comprising several cache memory levels.

[0030] Hereinafter, unless otherwise indicated, the term "word" designates both an instruction or portion of an instruction of the binary code of a process executable by the microprocessor 4 and a data item or portion of data corresponding to an operand on which an instruction executed by the microprocessor 4 operates.

[0031] The cache memory 6 serves as intermediate storage between the main memory 8 and the microprocessor 4. Instead of directly accessing the main memory 8, which has significant latencies, the microprocessor 4 first looks to see if the word is present in the cache memory. There are then the following two cases: Case 1): The word is present in the cache memory 6, which corresponds to the case known as the "hit" or "cache hit". In this case, the word is directly transferred to the microprocessor 4 from the cache memory 6. Memories higher than memory 6 are then not accessed to obtain this word. Case 2): The word is absent from the cache memory 6. This case corresponds to that known as the English term "miss" or "cache miss". In this case, the cache memory must search in a higher-ranking memory, that is to say typically in the main memory 8, for the absent word. This case is here called a "cache miss". The cache miss therefore naturally leads to a longer access time to the searched word.

[0032] In this embodiment, the cache memory 6 is a W-way associative memory, better known as “W-way associative”. In this case, the integer W is greater than or equal to two and generally less than 128 or 64 or 16.

[0033] The cache memory 6 typically comprises a support 7 for recording information. The support 7 is divided into several lines L i,j of fixed length. Each line comprises a data field D i,j. Each field D i,j is divided into N m words of fixed length. The lengths of a word, a field and a line are expressed by the number of bits that compose them. For example, the length of a word is typically equal to 32 bits or 64 bits. Subsequently, the description is made in the particular case where the length of a word is equal to 32 bits. Each field D i,j comprises an identical number of words. For example, here, each field D i,j comprises four words. Thus, the length of the field D i,j is 128 bits.

[0034] The lines of cache 6 are divided into W arrays W j , where W is an integer greater than one. Here, each array W j contains s lines of cache 6, where s is an integer equal to T / (WL), where: T is the size of the cache memory 6 expressed in bytes, L is the number of bytes per line, W is the number of arrays, and the symbol "." denotes the scalar multiplication operation.

[0035] These tables W j are known by the English term "Way". For illustration purposes, the remainder of this description is made in the special case where W is equal to four. To simplify the Figure 1 , only the tables W 1 and W 4 have been represented. In this figure, the lines that are not represented are symbolized by dotted lines. The index j is an identifier of the table W j . The index j is between 1 and W. The lines L i,j are all contained in the table W j . The tables W j are distinct from each other, that is to say that a line of the cache memory 6 is contained in only one of these tables W j .

[0036] The lines of the cache memory 6 are also grouped into distinct sets S i , where the index i is an identifier of the set S i among all other sets of lines used. These sets S i are known as "Set" or "Index". Each set S i contains W lines L i,j with each of the lines L i,j being contained in a respective array W j . Thus, the line L i,j is a line of the cache memory 6 that belongs to both the set S i and the array W j .

[0037] Each set S i in the cache memory 6 corresponds one-to-one to an address @ Si called a "row set address". There are therefore s different row set addresses @ Si here. Subsequently, the minimum number of bits required to encode the address @ Si of a set S i is, for example, equal to five so that s is equal to 2 5< .

[0038] The position of a particular word in the field D i,j is marked by an index "dr" which identifies the position of a word in the line L i,j . The index dr is a number between 1 and N m . Typically, words in the same field D i,j are placed immediately behind each other.

[0039] In addition to the field D i,j , each line L i,j has a line label T i,j called a "tag" in English. The label T i,j contains a value that allows the line L i,j containing the searched word to be unambiguously selected from the W lines L i,j of the set S i . For this, the label T i,j is constructed from the bits of the address @r of the searched word that have not already been used to determine the address @ Si of the set S i likely to contain the line L i,j and to determine the index dr . For example, a hash function can be applied to these bits of the address of the searched word to obtain the label T i,j .

[0040] The cache memory 6 also includes an electronic management unit 14. This unit 14 is notably configured to: in response to a request to read a word in the cache memory 6, send the word sought to the sender of the request if this word has been found in the cache memory 6 and otherwise, trigger a cache fault, and in response to a request to write a word in the cache memory 6, replace the old value of this word recorded on the medium 7 with its new value and, in the case where the word to be written could not be found in the cache memory 6, trigger a cache fault.

[0041] For example, when the unit 14 triggers a cache fault, it sends a request to a higher-ranking memory, typically here the main memory 8, to trigger the loading, into the cache memory 6, of the searched word. The unit 14 then manages the recording, in a line L i,j , of the word provided in response to its request.

[0042] By way of illustration, the microprocessor 4 conforms to the RISC (“Restricted Instruction Set Computer”) architecture. The microprocessor 4 comprises, in particular, a data input / output interface 28.

[0043] The interface 28 makes it possible to read words from the memory 6 and, alternately, to write words into the memory 6. Here, to read a word, the microprocessor 4 generates and sends via the interface 28 a request to read this word. This read request notably includes a physical or virtual address @r of the word to be read. The virtual address of a word is the address of this word in the memory space of the process executed by the microprocessor 4. This virtual address corresponds to a physical address in the main memory 8 where the searched word is stored. Conventionally, it is a conversion module known by the acronym MMU (“Memory Management Unit”) which is responsible for converting virtual addresses into physical addresses when this becomes necessary.

[0044] The @r address includes for this purpose: an address @ Si,r of a set S i,r of the cache memory 6 likely to contain the searched word; an index dr which identifies the position of the searched word in the field D i,j of the W lines L i,j of the set S i,r identified by the address @ Si,r , and a label T r which makes it possible to select without ambiguity, among the W lines L i,j of the set S i,r corresponding to the address @ Si,r , the line which contains the searched word if this line exists.

[0045] The label T r is typically constructed by implementing the same algorithm as that implemented to construct each of the labels T i,j stored in the cache memory 6. Thus, if one of the lines L i,j of the set S i,r contains the searched word, its label T i,j is identical to the label T r . This allows it to be unambiguously identified as the line that contains the searched word among the W lines L i,j of the set S i,r .

[0046] In this embodiment, the write and read requests received by the cache memory 200 additionally comprise: an identifier Id u of the process executed by the microprocessor 4 which issued this request, and a shared memory marker MP which indicates whether or not the word searched for is shared with other processes simultaneously executed by the computer 2.

[0047] Typically, the identifier Id u is a PID (“Process IDentifier”) assigned to any process executed by the microprocessor 4. For example, the identifier Id u is the process identifier known by the acronym ASID (“Address Space IDentifier”).

[0048] The MP marker can have an active and an inactive state. In the active state, it indicates that the word to be accessed is shared between several processes simultaneously executed by the computer 2. A shared word is the same word that can be read and / or written by several different processes. In the inactive state, the MP marker indicates that the word to be read or written is only used by the process that generated the request.

[0049] A request to write a word in memory 6 is, for example, practically identical to the read request except that it also includes a digital value V r containing the new value of the word to be recorded in cache memory 6.

[0050] There Figure 2 represents in more detail the unit 14 for managing the cache memory 6. The unit 14 is configured to implement the management method described in more detail with reference to the Figure 5 .

[0051] Unit 14 comprises registers in which the various data contained in the read or write request received by memory 6 are recorded. In this figure, the registers containing the label T r , the address @ Si,r , the index dr , the identifier Id u , the marker MP and the value V r bear, respectively, the references T r , @ Si,r , dr , Id u , MP and V r .

[0052] Unit 14 comprises a memory 38 and a hardware generator 40 of values Iw j,r for each of the indexes Iw j corresponding to the address @r received.

[0053] Typically, the memory 38 is only accessible by the components of the unit 14. Preferably, the memory 38 is a non-volatile memory. In particular, the information contained in the memory 38 cannot be read or written by processes executed by the microprocessor 4. Here, this memory 38 comprises a cryptographic key k and W indirection tables T j. Here, each indirection table T j is uniquely associated with a respective index, i.e. here with the index Iw j . Therefore, in this exemplary embodiment, the memory 38 comprises four tables T 1 to T 4 for the indexes, respectively, Iw 1 , to Iw 4 . The structures of all the tables T j are identical.

[0054] The generator 40 executes a bijective correspondence function which associates with each address @ Si,r one and only one set of W values Iw j,r . This set of values Iw j,r corresponds to the set S i,r since each value Iw j,r uniquely identifies one of the lines of the set S i,r .

[0055] The generator 40 receives, as input, the address @ Si,r . In addition, in this embodiment, it also receives as input, the label T r , the identifier Id u and the marker MP. As output, it returns, on a respective output, each of the generated values Iw j,r. For this purpose, the generator 40 has W outputs. Here, the value Iw j,r of each index Iw j is between 1 and s. The value Iw j,r therefore corresponds directly to the number of the line L i,j in the table T j

[0056] Here, the generator 40 comprises in particular for this purpose a cryptographic circuit 42 and a conversion circuit 44.

[0057] When the marker MP indicates that the word is not shared, the cryptographic circuit 42 generates four intermediate values I'w j,r as a function of the address @ Si,r , the label T r , the identifier Id u and the key k contained in the memory 38. Conversely, when the marker MP indicates that the word is shared, the cryptographic circuit 42 generates four intermediate values I'w j,r as a function of the address @ Si,r and the key k but without taking into account the identifier Id u and, possibly, the label T r . Each intermediate value I'w j,r is an integer between one and s.

[0058] The circuit 44 converts each intermediate value I'w j,r into a final value Iw j,r returned to the corresponding output of the generator 40. For this, the circuit 44 uses the indirection tables T j recorded in the memory 38. More precisely, the circuit 44 uses the intermediate value I'w j,r as a line number to select a line from the table T j and then extracts the corresponding final value Iw j,r from the selected line.

[0059] Unit 14 also includes the following components: a random or pseudo-random generator 48 of integers between 1 and s, a comparator 56, an automaton 60, a word extractor 62

[0060] The comparator 56 compares the received label T r with the labels T i,j of the lines of the set S i,r selected using the address @ Si,r . If one of the labels T i,j of the selected set S i,r corresponds to the label T r , then a signal for selecting this line L i,j as the one containing the searched word is generated. This selection signal therefore corresponds to the case of a "hit". In the opposite case, that is to say that none of the labels T i,j of the selected set S i,r corresponds to the label T r , a cache fault signal is generated. A label T i,j corresponds to the label T r if these two labels are identical.

[0061] The selection signal is, alternately, the cache fault signal is received by the automaton 60.

[0062] In parallel with comparator 56, extractor 62 extracts from the field D i,j of the same line L i,j as that currently processed by comparator 56, the word located at the position identified by the received index dr.

[0063] The 60 automaton is configured in particular to: select the W lines L i,j of the set S i,r corresponding to the address @ Si,r from the values Iw j,r generated by the generator 40, if one of the W lines L i,j selected triggers a success signal, then the automaton 60 triggers in response, in the case of a read request, the transmission of the extracted word, and, in the case of a write request, the writing of the value V r received at the location of the word located at the position identified by the index dr in the field D i,j of this line, and load from the main memory 8 and save in the cache memory 6 the word corresponding to the address @r contained in the received request if this word could not be found in the cache memory 6.

[0064] The structure of the table T j is represented on the Figure 3. The table T j has four columns and as many rows as there are possible values for the index Iw j . Here, it therefore has s rows numbered from 1 to s. The intersection between a column and a row forms a cell. Each cell is capable of containing a value. Thus, each row of the table T j has four cells C x,y,j , where the indices x and y are the numbers, respectively, of the row and the column of the table T j . The index x varies from 1 to s and the index y varies from one to four. To simplify the Figure 3 , only two lines corresponding to the line numbers, respectively, I'w j,r and I'w j,k have been represented.

[0065] The first column of table T j , that is, the one containing all cells C x,1,j , contains all possible values of index Iw j . Here, these possible values are integer values ranging from one to s. Thus, each cell C x,1,j contains one of these values. For example, here, cells C x,1,j of rows I'w j,r and I'w j,k contain the values, respectively, Iw j,r and Iw j,k of index Iw j .

[0066] The second column of table T j contains all cells C x,2,j . Each cell C x,2,j contains a counter CNT i,j associated with the row L i,j identified by the value of the index Iw j contained in the cell C x,1,j located on the same row.

[0067] The third column of table T j contains all cells C x,3,j . Each cell C x,3,j contains a validity bit Bv i,j associated with the line L i,j identified by the value of the index Iw j contained in the cell C x,1,j located on the same line. This bit Bv i,j is used to mark the line L i,j as valid and, alternately, invalid. Conventionally, a line L i,j marked as invalid must be treated as if it contained no words. Thus, a line L i,j marked as invalid is intended to be erased and replaced as a priority by another line loaded from the main memory 8. Here, when the line L i,j is valid, the bit Bv i,j is equal to "1". Conversely, the bit Bv i,j is equal to "0" when the line L i,j is invalid.

[0068] The fourth column of table T j contains all cells C x,4,j . Each cell C x,4,j contains a dirty bit Bs i,j associated with the row L i,j identified by the index value Iw j contained in the cell C x,1,j located on the same row. The bit Bs i,j is better known as the "dirty" bit. The bit Bs i,j is used to mark this row L i,j as having been modified. When a row L i,j is marked as having been modified, the field D i,j it contains is copied into the main memory 8 before, for example, this row is marked as invalid or evicted from the cache memory 6. Here, when the row L i,j has been modified, the bit Bs i,j is equal to "1". Conversely, the bit Bs i,j is equal to "0" when the row L i,j has not been modified.

[0069] There Figure 4represents in more detail a possible embodiment of the circuit 42 in the case where the MP marker is in its inactive state. In this embodiment, the circuit 42 comprises a concatenation circuit 70, a permutator 72, an “Exclusive OR” logic circuit 74, four substitution circuits 76 to 79 and four “Exclusive OR” logic circuits 80 to 83.

[0070] The circuit 70 receives as input the label T r , the address @ Si,r and the identifier Id u and returns, as output, a word M r formed by the concatenation of the bits of the label T r , the address @ Si,r and the identifier Id u . For example, here the label T r , the address @ Si,r and the identifier Id u are coded on, respectively, 39 bits, 5 bits and 16 bits. Thus, the word M r formed comprises 60 bits.

[0071] The permutator 72 permutes the bits of the word M r to obtain a word M' r then sends the first twenty bits M' r [0..19] of the word M' r to a first input of the circuit 74, the next twenty bits M' r [20..39] of the word M' r to a second input of the circuit 74 and the last twenty bits M' r [40..59] of the word M' r to a third input of the circuit 74.

[0072] Circuit 74 performs an “Exclusive OR” or XOR between the bits M' r [0..19], M' r [20..39] and M' r [40..59] to obtain a word M i coded on twenty bits.

[0073] The first five bits M i [0..4] are sent to an input of circuit 76, the next five bits M i [5..9] to an input of circuit 77, the next five bits M i [10..14] to an input of circuit 78 and the last five bits M i [15..19] to an input of circuit 79.

[0074] Circuits 76 to 79 substitute the bits received as input with other bits to generate four words Ms, to Ms 4 each transmitted on a first input, respectively, of circuits 80 to 83. For example, each circuit 76 to 79 is a circuit known as an “S-BOX”.

[0075] Circuits 80 to 83 receive on a second input, respectively, the first five bits k[0..4], the next five bits k[5..9], the next five bits k[10..14] and the last five bits k[15..19] of the key k.

[0076] Circuits 80 to 83 each perform an “Exclusive OR” or XOR and return on their outputs, respectively, the intermediate values I'w 1,r , I'w 2,r , I'w 3,r and I'w 4,r .

[0077] The operation of the computer 2 and the cache memory 6 will now be described with reference to the method of the Figure 5 .

[0078] When computer 2 is powered up, all lines of cache memory 6 are marked as invalid using bit Bv i,j . For this, the value "0" is written to all cells C x,3,j of all tables T j . For example, when computer 2 is first used, the numerical values from 1 to s are recorded, respectively, in cells C x,1,j of each table T j . In other words, at the start of the first use of computer 2, the value x is recorded in cell C x,1,j . During subsequent uses, the contents of cells C x,1,j are, for example, those stored at the end of the previous use. Thus, during subsequent uses, the values from 1 to s are not necessarily recorded in cells C x,1,j in ascending order of indices x.

[0079] After the computer 2 is powered up, the execution of at least one process is triggered. The computer 2 has the ability to execute several processes simultaneously. For this purpose, for example, the computer 2 executes an operating system that allows the simultaneous execution of these different processes by the microprocessor 4 to be scheduled in time. Thanks to this, all the processes are executed alternately by this same microprocessor 4. Similarly, the cache memory 6 is accessible and usable by all the processes executed simultaneously. In particular, to increase the efficiency and speed of execution of each of the processes, each of them can read and write words in any location of the medium 7. In other words, the medium 7 is not divided into several partitions, the use of each of these partitions being reserved for a single particular process.

[0080] The execution of several processes by a microprocessor is well known to those skilled in the art. Thus, only the accesses and management of the cache memory 6 are described in more detail below.

[0081] During a step 100, a request to read a word is received by the unit 14. This request is sent by a process executed by the microprocessor 4. This read request contains in particular the address @r of the word to be read and therefore the label T r , the address @ Si,r and the index dr . It also contains the identifier Id u of the process which sent this request as well as the state of the marker MP.

[0082] During a step 102, the label T r , the address @ Si,r , the index dr , the identifier Id u and the marker MP are recorded in the registers, respectively, T r , @ Si,r , dr , Id u and MP of the management unit 14.

[0083] During a step 104, the generator 40 then generates the four values Iw 1,r , Iw 2,r , Iw 3,r and Iw 4,r of the indexes, respectively, Iw 1 , Iw 2 , Iw 3 and Iw 4 .

[0084] For this, during an operation 106, the circuit 42 checks whether the received MP marker is in its inactive state. If so, the method continues with an operation 108. If not, the method continues with an operation 110.

[0085] In operation 108, circuit 42 constructs four intermediate values I'w 1,r , I'w 2,r , I'w 3,r and I'w 4,r as described with reference to Figure 4 .

[0086] Operation 110 is identical to operation 108 except that the bits of the identifier Id u are replaced by a predetermined constant value that is identical for all processes executed by the computer 2. For example, the bits of the identifier Id u are all set to zero. In this case, the generated intermediate values I'w 1,r , I'w 2,r , I'w 3,r and I'w 4,r do not vary as a function of the identifier Id u . Therefore, if two executed processes have the same address space, while the request containing the address @r is sent by one or the other of these processes, the intermediate values I'w 1,r , I'w 2,r , I'w 3,r and I'w 4,r are identical. Therefore, as will be understood from reading the rest of this description, the set S i,r is the same for these two processes since the tables T j are the same for all the processes. This therefore allows these two processes to share a word stored in the cache memory 6.

[0087] At the end of operation 108 or at the end of operation 110, during an operation 112, the circuit 44 converts the intermediate values I'w 1,r , I'w 2,r , I'w 3,r and I'w 4,r generated by the circuit 42 into final values Iw 1,r , Iw 2,r , Iw 3,r and Iw 4,r using for this the tables T 1 to T 4 .

[0088] The operation of circuit 44 is explained in the particular case of the conversion of an intermediate value I'w j,r into a final value Iw j,r using the table T j . What is described in this particular case is applied for each of the values of the index "j" between 1 and 4.

[0089] Circuit 44 selects, in the table T j , the cell C x,1,j which is located on the line whose number is equal to the value I'w j,r . The final value Iw j,r is then taken equal to the value contained in the cell C x,1,j thus selected. For example, by referring to the contents of the table T j represented on the Figure 3, the cell C x,1,j thus selected contains the final value Iw j,r .

[0090] Then, during a step 120, the automaton 60 selects from the support 7, the set S i,r of W lines L i,j located at the address @ Si,r . This set S i,r is formed by the W lines identified by the W final values Iw j,r obtained at the end of step 104. It is recalled that each value Iw j,r of the index Iw j points to a respective line in the table T j . Typically, the line identified by the index Iw j is the one whose line number is equal to the value Iw j,r .

[0091] In a step 122, the comparator 56 processes one after the other the W lines selected at the end of step 120. Successively, for each of the lines L i,j thus selected, the comparator 56 compares the label T i,j of this line with the label T r received. The comparator 56 transmits a success signal (“hit”) to the automaton 60 only if, for the line L i,j currently processed, the labels T i,j and T r are identical. In all other cases, the comparator 56 transmits a no-match signal to the automaton 60.

[0092] In parallel, during a step 124, the extractor 62 reads, in the field D i,j of the line L i,j currently processed by the comparator 56, the word located at the position identified by the index dr received.

[0093] In response to a success signal, during a step 126, the automaton 60 transmits to the microprocessor 4 the word extracted during step 124 and the method returns to step 100 to process the next read request.

[0094] If the comparator 56 has generated a signal of no correspondence for the W lines L i,j processed, the automaton 60 triggers a cache fault. The method then continues with a step 130 of supplying the searched word from a higher-ranking memory.

[0095] Step 130 begins with an operation 132 of selecting the line to be evicted from among the W current lines of the set S i,r . For this, the automaton 60 selects as a priority a line from the set S i,r whose bit Bv i,j indicates that it is invalid. For this purpose, for each line L i,j of the set S i,r , the automaton 60 reads the bit Bv i,j associated with this line L i,j by the table T j . More precisely, the automaton 60 reads the bit Bv i,j contained in the cell C x,3,j of the line of the table T j whose cell C x,1,j contains the value Iw j,r generated during step 104.

[0096] If only one row L i,j of the set S i,r is associated with a bit Bv i,j that indicates that this row is invalid, then this row is selected to be evicted. Otherwise, if several rows of the set S i,r are associated with bits Bv i,j that indicate that they are invalid, then any one of these rows is selected. Finally, if all the rows of the set S i,r are valid, that is, they are all associated with validity bits that indicate that they are valid, then any one of these rows is selected to be evicted.

[0097] Then, during an operation 134, the automaton 60 checks the state of the “dirty” bit associated with the selected line to be evicted. For this purpose, if the selected line to be evicted is the line L i,j , the automaton 60 reads the bit Bs i,j associated with this line L i,j by the table T j . More precisely, the automaton 60 reads the bit Bs i,j contained in the cell C x,4,j of the line of the table T j whose cell C x,1,j contains the value Iw j,r generated during the step 104, the index j being the index of the table W j which contains the line L i,j selected during the operation 132.

[0098] If during operation 134, bit Bs i,j indicates that this line has been modified since its recording on medium 7, then, during an operation 136, the content of its field D i,j is saved in a higher rank memory, that is to say here in memory 8.

[0099] Then, directly after operation 134 if the bit Bs i,j of the line to be evicted is equal to zero or at the end of operation 136, during an operation 140, the automaton 60 compares the value of the counter CNT i,j to a predetermined threshold SA . The counter CNT i,j is that associated with the line L i,j to be evicted by the table T j . For this, the automaton 60 reads the value contained in the cell C x,2,j of the line of the table T j whose cell C x,1,j contains the value Iw j,r generated during step 104, the index j being the index of the table W j which contains the line L i,j selected during operation 132.

[0100] If the value of the counter CNT i,j is lower than the threshold SA , then, during an operation 142, the line L i,j to be evicted is replaced, on the support 7, by a new line loaded from the higher rank memory and containing the searched word. For this, the new line is recorded on the support 7 in place of the line to be evicted.

[0101] Then, during an operation 144, the counter CNT i,j is incremented by a predetermined step, for example, equal to one. The bits Bv i,j and Bs i,j are also set, respectively, to “1” and “0”.

[0102] If the value of the counter CNT i,j is greater than or equal to the threshold SA, at the end of operation 140, the process continues with an operation 150.

[0103] In operation 150, a new row of the table W j , different from the row L i,j to be evicted, is selected. For example, for this purpose, the generator 48 is used to randomly draw a number between 1 and s and different from the current value Iw j,r of the index Iw j . Subsequently, the value thus drawn is denoted Iw j,k . For example, as illustrated in the Figure 3, this value Iw j,k corresponds to a line L k,j of the table W j , where the value of the index k is different from the value of the index i. The line L k,j is associated, by the table T j , with the counter CNT k,j and with the bits Bv k,j and Bs k,j .

[0104] During an operation 152, the automaton 60 permutes, in the table T j , the contents of the lines containing the values Iw j,r and Iw j,k of the index Iw j . During operation 152, only these two lines of the table T j are permuted and all the other indirection tables remain unchanged. At the end of operation 152, the cells of the table T j located on the line whose number is equal to I'w j,r contain, respectively, the values Iw j,k , CNT k,j , Bv k,j and Bs k,j . The cells of the table T j located on the line whose number is equal to I'w j,k contain, respectively, the values Iw j,r , CNT i,j , Bv i,j and Bs i,j . Thus, following this modification of the table T j , now, for a read request containing the same address @r, the same identifier Id u and the same marker MP, the value of the index Iw j is equal to Iw j,k and is no longer equal to Iw j,r .In other words, after operation 152, the set S i,r contains the line L k,j instead of the line L i,j .

[0105] Then, during an operation 154, the counters CNT k,j and CNT i,j are reset. For this, here, they are reset to zero in the table T j . In addition, the validity bit Bv i,j is set to zero to indicate that the line L i,j is now invalid.

[0106] Finally, during an operation 156, the line L k,j to be evicted is replaced, on the support 7, by a new line loaded from the higher-rank memory and containing the searched word. For this, if the bit Bs k,j associated with the line L k,j is equal to “1”, then the content of the field D k,j is first saved in the higher-rank memory. Then, the new line is recorded on the support 7 in place of the line L k,j . The bits Bv k,j and Bs k,j are then set, respectively, to “1” and “0”.

[0107] At the end of step 130, during a step 160, the searched word is read into the cache memory from the new line loaded during operation 142 or 156.

[0108] In the case of a request to write a word to the cache memory 6, everything previously described applies except that, instead of reading the searched word from the cache memory, the received value V r is written to the searched word. Chapter III: Variants Process variations:

[0109] In operation 132, other methods of selecting the line to be evicted are possible. For example, in a particularly simple variant, the line to be evicted is chosen without taking into account the state of the validity bits Bv i,j . For example, the line to be evicted is chosen randomly or pseudo-randomly from the W lines of the set S i,r . In this case, the validity bit Bv i,j can be omitted.

[0110] The permutation of two rows of the table T j during the execution of the process can be triggered differently. In particular, the use of the counters CNT i,j can be omitted. For example, as a variant, the permutation of the two values Iw i,j and Iw k,j of the index Iw j in the table T j is automatically triggered randomly in response to a cache miss. For example, operation 140 is replaced by an operation during which a number is randomly drawn. If this number is greater than or equal to the threshold SA , operations 150, 152 and 156 are executed. Otherwise, operation 142 is executed. In this case, operation 144 of incrementing the counter CNT i,j and operation 154 of resetting the counters are omitted. In another embodiment, unit 14 comprises a timer which counts down a duration T44.Each time the duration T44 has elapsed, in response to the next cache miss, the swapping of the two rows of the table T j is triggered. Thus, in this case, the time interval between two swaps of two rows of the tables T j is independent of the number of cache misses. In another embodiment, it is an event other than a cache miss that is counted to trigger the swapping of two rows of the table T j . For example, the execution of operations 150 and 152 is systematically triggered after a predetermined number of "hits" or on the basis of any other criterion. In another simplified variant, the execution of operations 150, 152 to 156 is triggered each time a cache miss occurs. In this case, operations 140, 142, 144 and 154 are omitted.

[0111] In operations 142 and 156 instead of copying only the line from the high-ranking memory that contains the searched word into the cache memory 6, W lines are copied from the high-ranking memory into the W lines of the set S i,r . Typically, W lines are adjacent, in the high-ranking memory, to the line that contains the searched word.

[0112] During operation 150, the selection of the new row L k,j in the table T j is not necessarily carried out randomly or pseudo-randomly. For example, as a variant, the new row is selected by implementing a deterministic function which, to each value of an input variable, associates a determined value Iw k,j respective of the index Iw j. The value of the input variable is determined from one or more values known at the time when the new row is to be selected. For example, it may be a value constructed from the values contained in the received read or write request. However, other values known to the unit 14 than those contained in the read or write request may be used for this.

[0113] During operation 144, other values are possible for the increment step of the counter CNT i,j . In particular, the increment step can also be negative. In this case, the initial value of the counter CNT i,j assigned to this counter during operation 154 is a value greater than the threshold SA . Variants of the generator of index values Iw j:

[0114] The label T r can be constructed from both the physical address @rr of the searched word and the virtual address @rv of this searched word. Indeed, it is always possible to convert a physical address into a virtual address and vice versa. This is typically the function of the memory management unit known by the acronym MMU ("Memory Management Unit"). Thus, if at the time when unit 14 receives the request to read or write a word, the physical address @rr is known, then unit 14 uses this address @rr to extract the address @ Si,r , the label T r and the index dr . This situation is encountered almost systematically if cache memory 6 is an L2 cache memory or higher. In the case where cache memory 6 is an L1 cache memory, it may be that at the time when unit 14 receives this request, only the virtual address @rv is available.In this case, the generator 40 uses the address @rv to extract the label T r and the address @ Si,r . Thus, in this case, the values Iw j,r are generated from the virtual address @rv and not from the physical address @rr . Along the way, the physical address @rv becomes available and, in particular, steps 122, 124 and 126 are carried out using this physical address and not the virtual address of the word to be read or written.

[0115] The generator 40 may take into account other additional information contained in the read or write request to generate the values of the indexes Iw j . For example, the generator may additionally use the index dr .

[0116] Conversely, the generator 40 can also take into account less information than that described previously to generate the values of the indexes Iw j . For example, systematically, the label T r is not taken into account to generate the values Iw j,r of the indexes Iw j . In another very simplified variant, the process identifiers Id u are omitted and are never used to construct the values Iw j,r of the row indexes Iw j.

[0117] In step 110, to share the searched word between several processes, if necessary, the label T r is replaced by a constant and identical value for all processes. This may be necessary if the label T r is extracted from the virtual address @rv and not from the physical address @rr of the searched word.

[0118] In another embodiment, the shared memory marker MP is omitted. In this case, it is not possible to share a word stored in the cache memory between several processes simultaneously executed by the computer. For this, typically, the identifier Id u of each executed process is systematically used to generate the values of the indices Iw j .

[0119] Other embodiments of the cryptographic circuit 42 are possible. For example, the circuit 42 may perform a more complex cryptographic function than that previously described to generate the intermediate values I'w j,r . For example, the cryptographic function performed by the circuit 42 may be identical to the IDF function used in the Scattercache solution. Conversely, preferably, the cryptographic function may also be simpler than that previously described. For example, the permutator 72 or the substitution circuits 76 to 79 are omitted.

[0120] The key k can also be omitted. In this case, the generated Iw j,r values are independent of this key k.

[0121] In a very simplified variant, the cryptographic circuit 42 is omitted. For example, in this case, the intermediate values I'w j,r are all taken equal to the address @ Si,r .

[0122] The number of indirection tables used is not necessarily equal to W. For example, to save memory, as a variant, the number of indirection tables is less than W. In this case, several Iw j indexes are associated with the same indirection table T k common to these Iw j indexes. Therefore, the same table T k is used, for several different Iw j indexes, to transform the intermediate value l'w j,r of this Iw j index into a corresponding final value Iw j,r . This still makes it possible to obtain different Iw j,r values for these different Iw j indexes because the intermediate values I'w j,r are different from each other. In an extreme case, a single indirection table associated with all Iw j indexes is used. Other variants:

[0123] Alternatively, the counters CNT i,j and / or the “dirty” bits Bs i,j and / or the validity bits Bv i,j are recorded directly on the medium 7 and not in the indirection tables T j . Typically, in this case, the counter CNT i,j , the bit Bs i,j and the bit Bv i,j associated with the line L i,j are recorded directly in this line on the medium 7 at predefined locations and distinct from the word(s) contained in this same line L i,j .

[0124] Here, the terms "valid bit" and "dirty bit" each refer to information that can be encoded using a single bit. However, alternatively, although the information can be encoded using a single bit, it is possible to encode it using multiple bits.

[0125] Alternatively, the value of the SA threshold is dynamically adjusted by the computer during process execution. For example, the computer records the current cache miss rate. If the current cache miss rate crosses a threshold, then the value of the SA threshold is lowered to swap two values from the indirection table more frequently.

[0126] The cache memory can be divided into different levels of cache memory traditionally called "L1 cache", "L2 cache", "L3 cache", etc. The access times to these different levels increase going from the L1 cache to the L3 cache. In addition, these different levels of cache memory are not necessarily implemented on the same die. For example, the L1 cache can be implemented inside the microprocessor 4 while the higher levels are implemented outside the microprocessor 4. The methods for managing a cache memory described here are applicable to each of these levels of cache memory. Preferably, the methods described here are applied to each of these levels.

[0127] The number W of array W j can be equal to one, two or three or be greater than four or six.

[0128] The teaching given here also applies to the case of direct mapped cache memories. In this case, the number W is equal to one and the address @Si,r corresponds to a single line of the cache memory.

[0129] The mass memory may be located outside the computer and connected to this computer by a bus or an information transmission network. Similarly, the main memory may also be mechanically located outside the computer and connected to this computer by a bus or an information transmission network.

[0130] What has been described here applies to other word and line lengths.

[0131] In another embodiment, the index dr is omitted in the request to read a word in the cache memory. In this case, in the event of a match between the label T r and one of the labels T i,j , the cache memory 6 sends the complete field D i,j to the microprocessor 4. It is then the microprocessor 4 which itself proceeds to extract the desired word in the received field D i,j.

[0132] Instead of comprising a single microprocessor, the electronic computer may comprise several microprocessors, each capable of accessing the cache memory 6. In this case, each process executed in parallel with the others is, for example, executed by its own microprocessor. What has been described here in the particular case where the different processes are executed, in parallel, by the same microprocessor 4 works in the same way in the case of such an electronic computer equipped with several microprocessors.

[0133] Several of the embodiments described herein may be combined with each other to obtain a new embodiment. Chapter III: Advantages of the embodiments

[0134] Using at least one indirection table T j to generate the values Iw j,r of the indexes Iw j and swapping, in response to a cache miss, only two values of this indirection table makes it possible to modify, little by little and during the execution of the process, the spatial distribution of the lines of the cache memory 6 used by this process. Unlike a change of the key k or the SDID identifier in the Scattercache solution, the spatial randomization of the lines of the cache memory 6 used by the process is not static and evolves little by little. Thus, the slowdown in the execution of the process due to a very large number of cache misses following the change of the key k or the SDID identifier does not occur. The method for managing a cache memory described here also makes it possible to simplify the IDF function described in the Scattercache solution without reducing the security of the method.Indeed, in the method described here, the spatial randomization is already obtained by the permutations of the values in the indirection tables T j . Therefore, it is not necessary to use a complicated cryptographic function to implement the circuit 42. The method described here also makes it possible to retain the advantages of the method described in the Scattercache solution. In particular, in the case of an associative cache memory, where W is greater than one, the lines corresponding to the same set address @ Si,r are not located next to each other in the cache memory and are not necessarily located at the same location in each of the tables W j . Thus, this makes it possible to maintain good spatial randomization of these lines inside the cache memory while adding temporal randomization. Here, "temporal randomization" refers to frequently changing the spatial randomization.

[0135] Triggering the permutation of the two values Iw j,r and Iw j,k of the index Iw j in the indirection table T j only when the value of the counter CNT i,j associated with the line to be evicted crosses the threshold SA , simply allows adjusting the frequency at which the permutations take place during the execution of the process. Indeed, to do this, it is sufficient to modify the value of the threshold SA .

[0136] Recording the counter CNT i,j, the bit Bs i,j or the validity bit Bv i,j in the indirection table T j rather than on the support 7, allows faster access to this information which speeds up the execution of the process.

[0137] Using the process identifier Id u to generate the values of the indexes Iw j , allows the use of cache memory lines that differ depending on the process. Thus, it is difficult for an attacking process executed by the computer 2 to simply access the lines used by another process executed simultaneously. Moreover, to achieve this result, it is not necessary to partition the cache memory between the different executed processes.

[0138] By not taking into account the process identifier Id u to generate the values of the W index Iw j when the shared memory marker MP is in the active state, it is possible to share a word stored in the cache memory between several processes.

[0139] Random or pseudo-random selection of the new line L k,j makes the location of this new line in the cache memory more unpredictable. This therefore makes identifying the cache lines used by an attacked process more complicated.

[0140] Systematically switching the validity bit Bv i,j to the "invalid" state after the line L i,j has been replaced by the line L k,j , makes it possible to evict as a priority those lines which are no longer used and therefore to limit the number of times a line must be saved in a higher-ranking memory.

[0141] Using the key k stored in the memory 38 of the cache memory management unit 14 to select a cell C x,1,j in the table T j makes it possible to reinforce the robustness of the method. Indeed, the key k is not known to any of the processes executed by the computer 2 so that it is very difficult to predict the location where the words are stored in the cache memory 6. In addition, the key k is stored in a memory 38 which is not accessible by the processes executed.

Claims

1. Method for managing a cache memory of an electronic computer, this method comprising the following steps during execution by this computer of a process that must process a word: (a) receiving (100) a request containing an address of the word to be read or written, the address comprising: - a received line tag, - a received set address, this received set address belonging to a first set of s different values, where the number s is an integer greater than two, then b) generating (104), depending on the set address received in step a), a respective first value for each line index of a group of W different line indices, where W is a predetermined integer greater than or equal to one, each line index pointing to one respective way of s different lines of the cache memory and its value uniquely identifying a single line of the way to which it points, each line identified by the first value of a line index comprising a pre-stored line tag, then c) comparing (122) the received line tag to the line tags of the lines identified by the first values of the W line indices generated in step b), to determine whether any of these line tags corresponds to the received line tag, d) when none of the line tags compared in step c) corresponds to the received line tag, triggering a cache miss and retrieving the word from a memory of higher rank, and when, conversely, one of the line tags compared in step c) corresponds to the received line tag, reading (124) from or writing to the cache memory the word inside the line containing the line tag that corresponds to the received line tag, wherein: - step b) comprises, for each of the W line indices, selecting (112), depending on the set address received in step a), a first cell in a first column of a pre-stored indirection table associated with this line index and using, as first value generated for this line index, the value contained in this first cell, - in step d), in response to triggering of a cache miss, the method comprises the following operations: d1) storing (156) the word retrieved from the memory of higher rank in a new line identified by a second line-index value that points to the way containing this new line, this second value being different from the first value of this line index generated in step b) and being contained in a second cell of the first column of the indirection table associated with this line index, this second cell being different from the first cell, and d2) permutating (152), in the first column of the indirection table associated with the line index that points to the way containing the new line, only values contained in the first and second cells, so that after this permutation the first cell contains the second value and the second cell contains the first value.

2. Method according to Claim 1, wherein, in step d), in response to triggering of a cache miss, the method comprises: - selecting (132) a line to be removed among the W lines identified by the first values of the W line indices generated in step b), then - comparing a counter associated with the selected line to be removed, to a predetermined threshold, and - when this comparison indicates that the value of this counter has crossed the predetermined threshold, executing operations d1) and d2) and resetting (154) this counter and, conversely, when this comparison indicates that the value of this counter has not yet crossed the predetermined threshold, storing (142) the word retrieved from the memory of higher rank in the selected line to be removed and incrementing (144) the counter associated with this line to be removed.

3. Method according to Claim 2, wherein the counter is stored in a second column of the indirection table associated with the line index that points to the way containing the line to be removed.

4. Method according to anyone of the preceding claims, wherein the method comprises: - using a dirty bit associated with each line of the cache memory to determine whether, before removing that line from the cache memory, the word or words contained in that line must first be saved in a memory of higher rank, and - storing (156) the dirty bit associated with each line of the cache memory in a third column of the indirection table associated with the line index that points to the way containing that line.

5. Method according to anyone of the preceding claims, wherein the method comprises: - using a validity bit associated with each line of the cache memory to determine whether that line must be selected as a priority to be removed from the cache memory, and - storing (154, 156) the validity bit associated with each line of the cache memory in a fourth column of the indirection table associated with the line index that points to the way containing that line.

6. Method according to anyone of the preceding claims, wherein: - in step a), the received request also comprises a received process identifier that distinguishes the process that issued this request from all the other processes simultaneously executed by the electronic computer, - in step b), the first values of the W line indices are also generated depending on the process identifier received in step a).

7. Method according to Claim 6, wherein: - in step a), the received request also comprises a shared memory marker that indicates whether or not the word to be read or written is shared with other processes simultaneously executed by the electronic computer, and - in step b), when the shared memory marker indicates that the word to be read or written is not shared with other processes simultaneously executed by the electronic computer, the first values of the W line indices are also generated depending on the process identifier received in step a) and, otherwise, when the shared memory marker indicates that the word to be read or written is shared with other processes simultaneously executed by the electronic computer, the first values of the W line indices are generated without taking into account the process identifier received in step a).

8. Method according to anyone of the preceding claims, wherein operation d1) comprises randomly or pseudo-randomly selecting the new line from lines of a way that are different from the line identified by the first value of the line index that points to that way.

9. Method according to anyone of the preceding claims, wherein the method comprises: - using a validity bit associated with each line of the cache memory to determine whether that line must be selected as a priority to be removed from the cache memory, this validity bit being switchable between: - an "invalid" state in which it indicates that this line must be selected as a priority to be removed from the cache memory, and - a "valid" state in which it indicates that this line must not be selected as a priority to be removed from the cache memory, and - in response to execution of operation d2), the validity bit associated with the line of the cache memory identified by the first value of the line index that points to the way containing the new line is systematically set (154) to the "invalid" state.

10. Method according to anyone of the preceding claims, wherein W is greater than or equal to two.

11. Method according to Claim 10, wherein each line index is associated with its own indirection table.

12. Method according to anyone of the preceding claims, wherein step b) comprises, for each line index: - constructing (108, 110) an intermediate value of this line index from the set address received in step a) and a secret cryptographic key contained in a non-volatile memory inaccessible by the processes executed by the computer, then - selecting (112), depending on the set address received in step a), a first cell in a first column of the pre-stored indirection table associated with this line index, this consisting in selecting the cell of this indirection table that is located on the line of this indirection table the index of which is equal to the intermediate value constructed for this line index.

13. Hardware unit for managing a cache memory of an electronic computer, this unit being configured to carry out the following steps during execution by this computer of a process that must process a word: (a) receiving a request containing an address of the word to be read or written, the address comprising: - a received line tag, - a received set address, this received set address belonging to a first set of s different values, where the number s is an integer greater than two, then b) generating, depending on the set address received in step a), a respective first value for each line index of a group of W different line indices, where W is a predetermined integer greater than or equal to one, each line index pointing to one respective way of s different lines of the cache memory and its value uniquely identifying a single line of the way to which it points, each line identified by the first value of a line index comprising a pre-stored line tag, then c) comparing the received line tag to the line tags of the lines identified by the first values of the W line indices generated in step b), to determine whether any of these line tags corresponds to the received line tag, d) when none of the line tags compared in step c) corresponds to the received line tag, triggering a cache miss and retrieving the word from a memory of higher rank, and when, conversely, one of the line tags compared in step c) corresponds to the received line tag, reading from or writing to the cache memory the word inside the line containing the line tag that corresponds to the received line tag, wherein the managing hardware unit is also configured to: - in step b), for each of the W line indices, select, depending on the set address received in step a), a first cell in a first column of a pre-stored indirection table associated with this line index and use, as first value generated for this line index, the value contained in this first cell, - in step d), in response to triggering of a cache miss, execute the following operations: d1) storing the word retrieved from the memory of higher rank in a new line identified by a second line-index value that points to the way containing this new line, this second value being different from the first value of this line index generated in step b) and being contained in a second cell of the first column of the indirection table associated with this line index, this second cell being different from the first cell, and d2) permutating, in the first column of the indirection table associated with the line index that points to the way containing the new line, only values contained in the first and second cells, so that after this permutation the first cell contains the second value and the second cell contains the first value.