Cache management method

Abstract

Method for managing a cache memory. This method comprises: - the selection (112), based on the address of a word to be read or written, of a first cell in an indirection table and the use, as the first generated value for a row index, of the value contained in this first cell, and - in response to the triggering of a cache fault: - the recording (156) of the word provided from a higher-rank memory in a new row identified by a second value of the row index, this second value being contained in a second cell of the indirection table, and - the permutation (152), in the indirection table, of only the values ​​contained in the first and second cells such that after this permutation the first cell contains the second value and the second cell contains the first value. Fig. 5

Description

Title of the invention: Method for managing a cache memory

[0001] The invention relates to a method and a unit for managing a cache memory of an electronic computer.

[0002] Cache memories are used so that a process executed by a microprocessor can more quickly access information initially stored in the main memory.

[0003] In this application, by "process" we mean both a program and a routine of this program or any other software executed by the computer and capable of reading or writing in the cache memory.

[0004] The state of the cache memory depends heavily on the addresses that have been accessed by the process(es) executed by the computer. Furthermore, the state of the cache memory at a given time can be observed quite easily by a third-party process executed by the computer or simply by measuring the access times to the cache memory.

[0005] These characteristics of a cache memory have been exploited to develop attacks known as "side channel attacks". These attacks make it possible to reveal secret information processed by an executed process or to modify the operation of the executed process to circumvent security measures. For example, secret information is a cryptographic key used to encrypt or decrypt information. A security measure is, for example, entering a PIN code.

[0006] To achieve this, side-channel attacks observe the state of the cache memory while the attacked process is running to determine the address(es) accessed by this attacked process. The addresses accessed depend on secret data processed by the attacked process. Thus, knowing the addresses accessed by the attacked process makes it possible to obtain information about this secret data. In general, these attacks assume the execution of an attacking process in parallel with the attacked process. This attacking process must be able to access specific addresses in the cache memory. This is particularly the case for the attack known as "Prime & Probe".

[0007] To increase the robustness of the cache memory against these attacks, it has been proposed to randomly scatter the cache memory lines accessed by a process. This is known as "spatial randomization".

[0008] Such a particularly effective spatial randomization solution is described in the following article: M. Wemer, T. Unterluggauer, L. Giner, M. Schwarz, D. Gruss, and S. Mangard, “SCATTERCACHE: Thwarting Cache Attacks via Cache Set Randomization,” USENIX Security Symposium, 2019, pages 675-692. Subsequently, this solution is referred to as “Scattercache”.

[0009] More precisely, this article teaches that when a first process seeks to read a word at an address @r, it transmits a request to the cache memory. This request contains the address @r. The address @r contains an address @Si,r of a set Si>r of lines of the cache memory likely to contain the searched word. This address @Si>r is often referred to by the English terms "set" or "index". In the Scattercache solution, the address @Si,r is transmitted to a cryptographic function IDF which constructs, in particular from the address @Si>r, the values ​​of W line index Iwi to Iww, where W is an integer greater than one. Each index Iwj points to a respective table Wj, where the index j is an identifier of the table Wj. The index j is here an integer between 1 and W. These tables Wj are better known by the English term "Way". Each table Wj contains s distinct lines of the cache memory.The arrays Wj are distinct from each other, that is, they have no rows in common. The value of the index Iwj uniquely identifies a row of the array Wj. The set Si>r is only composed of the W rows identified by the values ​​of the W indexes Iwj constructed by the IDF function.

[0010] If the searched word is not found in this set Si>r of lines, then this causes a cache fault, better known as a "miss". In the event of a cache fault, a set of new lines containing the searched word is loaded into the cache memory from the main memory of the electronic calculator. The new loaded lines are stored in place of the previous lines in the set Si>r.

[0011] Due to the organization in distinct tables and thanks to the use of different indexes Iwj to point to each table Wj, the lines of the set Si>r are not located next to each other in the cache memory and are not located in the same location in each of the tables Wj. This allows for much greater spatial randomization. Thus, the observation of the state of the cache memory, and in particular of the set Si>r, by an attacking process is more difficult.

[0012] In addition, the cryptographic function IDF is parameterized by a secret key k that can be modified. This key k is managed by a hardware module of the computer, which guarantees its confidentiality. However, in practice, it is not possible to modify the key k during the execution of a process. Indeed, after the modification of the key k, for the same address @Si,r received, the values ​​constructed for each of the indexes Iwj are different from those constructed for this same address @Si,r and for the same process before the modification of the key k. In other words, after the modification of the key k, the address @Si,r corresponds to a new set S'i>r of lines and no longer to the set Si>r. Therefore, during the first access to the set S'i>r after the modification of the key k, the word that the process wishes to access is not in this set S'i>r which systematically causes a cache miss. Moreover, this cache miss occurs systematically for all executed processes and for all possible addresses @Si>r. Thus, modifying the key k during the execution of a process triggers a very large number of cache misses which substantially slows down the execution of the processes. To avoid this problem, the Scattercache solution proposes to change the key k only when the computer is powered on.

[0013] In the Scattercache solution, the values ​​of the indexes Iwj are also calculated using an SDID identifier. Unlike the key k, the SDID identifier is managed by a software module. Thus, the security of this SDID identifier is lower than that of the key k. Moreover, similarly to what was explained in the case of a modification of the key k, a modification of the SDID identifier triggers a large number of cache faults. Therefore, as for the key k, in practice, the SDID identifier cannot be modified frequently.

[0014] Due to the above limitations of the Scattercache solution, with this solution the spatial randomization is static or practically static during the execution of a process. Therefore, an attacking process can still manage to identify the cache lines used by an attacked process.

[0015] The invention aims to propose a method for managing the cache memory of an electronic computer that is more robust than the Scattercache solution.

[0016] The subject of the invention is therefore a method for managing a cache memory of an electronic computer, this method comprising the following steps during the execution by this computer of a process which must process a word:

[0017] a) receiving a request containing an address of the word to be read or written, this address comprising:

[0018] - a received line label,

[0019] - a received set address, this received set address belonging to a first set of s different values, where the number s is an integer greater than two, then

[0020] b) generating, as a function of the set address received in step a), a first respective value for each row index of a group of W different row indices, where W is a predetermined integer greater than or equal to one, each row index pointing to a respective array of s different rows of the cache memory and its value uniquely identifying a single row of the array to which it points, each row identified by the first value of a row index comprising a pre-recorded row label, then

[0021] c) comparing the received line label with the line labels of the lines identified by the first values ​​of the W line indices generated during step b), to determine whether one of these line labels matches the received line label,

[0022] d) when none of the row labels compared in step c) corresponds to the received row label, triggering a cache fault and providing the word from a higher-ranking memory, and when, on the contrary, one of the row labels compared in step c) corresponds to the received row label, reading or writing in the cache memory the word inside the row containing the row label which corresponds to the received row label,

[0023] in which:

[0024] - step b) comprises, for each of the W row indexes, the selection, as a function of the set address received in step a), of a first cell in a first column of a pre-recorded indirection table associated with this row index and the use, as the first value generated for this row index, of the value contained in this first cell,

[0025] - during step d), in response to the triggering of a cache fault, the method includes the following operations:

[0026] dl) recording the word supplied from the higher-ranking memory in a new row identified by a second value of the row index that points to the table containing this new row, this second value being different from the first value of this row index generated during step b) and being contained in a second cell of the first column of the indirection table associated with this row index, this second cell being different from the first cell, and

[0027] d2) the permutation, in the first column of the indirection table associated with the row index that points to the array containing the new row, only values ​​contained in the first and second cells so that after this permutation the first cell contains the second value and the second cell contains the first value.

[0028] Embodiments of this method may include one or more of the following features:

[0029] 1) In step d), in response to the triggering of a cache fault, the method includes:

[0030] - the selection of a line to be evicted from among the W lines identified by the first values ​​of the W row indexes generated in step b), then

[0031] - the comparison of a counter associated with the selected line to be evicted, to a threshold predetermined, and

[0032] - when it results from this comparison that the value of this counter has crossed the threshold predetermined, the execution of operations dl) and d2) and the resetting of this counter and, conversely, when it results from this comparison that the value of this counter has not not yet crossed the predetermined threshold, the recording of the word provided from the higher-ranking memory, in the selected line to be evicted and the incrementation of the counter associated with this line to be evicted.

[0033] 2) The counter is recorded in a second column of the indirection table associated with the row index that points to the table containing the row to be evicted.

[0034] 3) The method comprises:

[0035] - the use of a dirty bit associated with each line of the cache memory to clear terminate if, before evicting this line from the cache memory, it is first necessary to save the word(s) contained in this line in a higher-ranking memory, and

[0036] - recording the dirty bit associated with each line of the cache memory in a third column of the indirection table associated with the row index that points to the table containing that row.

[0037] 3) The method comprises:

[0038] - the use of a validity bit associated with each line of the cache memory to de terminate if this line should be prioritized for eviction from the cache, and

[0039] - recording the validity bit associated with each line of the cache memory in a fourth column of the indirection table associated with the row index that points to the table containing that row.

[0040] 4)

[0041] - during step a), the received request also includes a process identifier receipt which distinguishes the process which issued this request from all other processes simultaneously executed by the electronic computer,

[0042] - during step b), the first values ​​of the W row indexes are also generated based on the process ID received in step a).

[0043] 5)

[0044] - during step a), the received request also includes a memory marker shared which indicates whether or not the word to be read or written is shared with other processes simultaneously executed by the electronic computer, and

[0045] - during step b), when the shared memory marker indicates that the word to be read or to be written is not shared with other processes simultaneously executed by the electronic computer, the first values ​​of the W line indexes are also generated according to the process identifier received during step a) and, otherwise, when the shared memory marker indicates that the word to be read or written is shared with other processes simultaneously executed by the electronic computer, the first values ​​of the W line indexes are generated without taking into account the process identifier received during step a).

[0046] 6) Operation dl) involves the random or pseudo-random selection of the new row among the rows of a table other than the row identified by the first value of the row index that points to that table.

[0047] 7) The method comprises:

[0048] - the use of a validity bit associated with each line of the cache memory to de terminate if this line should be selected as a priority to be evicted from the cache memory, this validity bit being switchable between:

[0049] - an “invalid” state where it indicates that this line must be selected as a priority to be evicted from the cache, and

[0050] - a “valid” state where it indicates that this line should not be selected in priority to be evicted from the cache memory,

[0051] - in response to the execution of operation d2), the validity bit associated with the line of the cache memory identified by the first value of the row index that points to the table containing the new row, is systematically put in the “invalid” state.

[0052] 8) W is greater than or equal to two.

[0053] 9) Each row index is associated with its own indirection table.

[0054] 10) Step b) comprises for each row index:

[0055] - the construction of an intermediate value of this row index from the address of the set received during step a) and a secret cryptographic key contained in a non-volatile memory inaccessible by the processes executed by the computer, then

[0056] - the selection, as a function of the set address received during step a), of a first cell in a first column of the pre-recorded indirection table associated with this row index, consists of selecting the cell of this indirection table which is located on the row of this indirection table whose index is equal to the intermediate value constructed for this row index.

[0057] The invention also relates to a hardware unit for managing a cache memory of an electronic computer, this unit being configured to carry out the following steps during the execution by this computer of a process which must process a word:

[0058] a) receiving a request containing an address of the word to be read or written, this address comprising:

[0059] - a received line label,

[0060] - a received set address, this received set address belonging to a first set of s different values, where the number s is an integer greater than two, then

[0061] b) generating, as a function of the set address received during step a), a first respective value for each row index of a group of W row indexes different lines, where W is a predetermined integer greater than or equal to one, each line index pointing to a respective array of s different lines of the cache memory and its value uniquely identifying a single line of the array to which it points, each line identified by the first value of a line index having a pre-recorded line label, then

[0062] c) comparing the received line label to the line labels of the lines identified by the first values ​​of the W line indices generated during step b), to determine whether one of these line labels corresponds to the received line label,

[0063] d) when none of the row labels compared in step c) corresponds to the received row label, triggering a cache fault and providing the word from a higher-ranking memory, and when, on the contrary, one of the row labels compared in step c) corresponds to the received row label, reading or writing in the cache memory the word inside the row containing the row label which corresponds to the received row label,

[0064] wherein the hardware management unit is also configured to:

[0065] - during step b), for each of the W row indexes, select, as a function of the set address received in step a), of a first cell in a first column of a pre-recorded indirection table associated with this row index and using, as the first value generated for this row index, the value contained in this first cell,

[0066] - during step d), in response to the triggering of a cache fault, execute the following operations:

[0067] dl) storing the word supplied from the higher-ranking memory in a new row identified by a second value of the row index that points to the table containing this new row, this second value being different from the first value of this row index generated during step b) and being contained in a second cell of the first column of the indirection table associated with this row index, this second cell being different from the first cell, and

[0068] d2) permute, in the first column of the indirection table associated with the index of row that points to the table containing the new row, only values ​​contained in the first and second cells so that after this permutation the first cell contains the second value and the second cell contains the first value.

[0069] The invention will be better understood on reading the description which follows, given solely by way of non-limiting example and made with reference to the drawings in which:

[0070] - [Fig.l] is a schematic illustration of the architecture of an electronic calculator electronics equipped with cache memory;

[0071] - [Fig.2] is a schematic illustration of a memory management unit calculator cache of [Fig.l];

[0072] - [Fig.3] is a schematic illustration of the structure of an indirection table used by the management unit of [Fig.2];

[0073] - [Fig.4] is a schematic illustration of the architecture of a crypto circuit graphic implemented in the management unit of [Fig.2];

[0074] - [Fig.5] is a flowchart of a method for managing the cache memory of the calculator of [Fig.l].

[0075] In these figures, the same references are used to designate the same elements. In the remainder of this description, the characteristics and functions well known to those skilled in the art are not described in detail.

[0076] In this description, detailed examples of embodiments are first described in a chapter I with reference to the figures. Then, in a chapter II, variants of these embodiments are introduced. Finally, the advantages of the different embodiments are specified in a chapter III.

[0077] Chapter I: Example of embodiment

[0078] [Fig.l] schematically represents the architecture of an electronic computer 2. This computer 2 is typically integrated into a larger system 3 of which it controls and commands at least part of the operation. The system 3 is for example a computer, a mobile phone, a smartphone or any other electronic device whose operation is controlled, at least in part, by the computer 2.

[0079] Conventionally, the calculator 2 comprises:

[0080] - at least one microprocessor 4,

[0081] - a cache memory 6,

[0082] - a main memory 8,

[0083] - a mass memory 10, and

[0084] - information transmission buses 12 which connect these different elements of the calculator 2.

[0085] The cache memory 6 is typically faster than the main memory 8, which is itself faster than the mass memory 10. The speed of a memory corresponds to the access time required to access information recorded in this memory. Currently, typically, the access time of a cache memory is less than 30 ns or 20 ns and, generally, greater than 1 ns. The access time to a main memory is today typically less than 500 ns or 100 ns and, generally, greater than 30 ns or 50 ns. The access time to a mass memory is today typically greater than 1 ps or 10 ps and, generally, less than 10 ms.

[0086] Typically, the size of a memory of the computer 2 is all the smaller as This memory is fast. Thus, the size of the cache memory 6 is smaller than the size of the main memory 8, which is itself smaller than the size of the mass memory 10. The size of a memory is expressed in bytes. The size of the cache memory 6 is, for example, less than 4 MB and usually greater than 60 KB. The size of the main memory 8 is usually greater than 256 MB or 1 GB and, generally, less than or equal to 16 GB or 32 GB. The size of the mass memory 10 is usually greater than 4 GB or 1 TB.

[0087] Here, the memories of the computer 2 are classified by increasing access time. Thus, subsequently, the expression “higher rank memory” designates a memory whose access time is greater than the current memory.

[0088] Generally, memories 6 and 8 are volatile random access memories. For example, memory 6 is a SRAM (Static Random Access Memory) type memory. Main memory 8 is, for example, a DRAM (Dynamic Random Access Memory) type memory.

[0089] The mass memory 10 is generally a non-volatile memory. Many different technologies exist for making such a mass memory. For example, the memory 10 may be a magnetic tape, a hard disk, an optical disk such as a CD, a DVD or a blue-ray disk, a magneto-optical disk, a flash memory, an SSD (“Solid State Drive”) memory or others.

[0090] The memory 10 contains, for example, a backup copy of the binary code of the processes to be executed by the microprocessor 4. The memory 10 may also contain copies of the data to be processed by the various processes that may be executed by the microprocessor 4. Typically, the binary code of the processes and the data to be processed are, for example, loaded into the memory 8 from the memory 10 when the computer 2 is powered up and / or in response to a reset command from the computer 2 or when the execution of a new process by the computer 2 is triggered.

[0091] The memory 6 may be a memory external to the microprocessor 4 as shown in [Fig.l]. In this case, the memory 6 is, for example, produced on a substrate mechanically separated from the substrate on which the different elements of the microprocessor 4 are produced.

[0092] To simplify the description, it is considered here that the memory 6 comprises a single cache memory level, that is to say typically the level known under the expression “L1 cache”. However, everything that is described subsequently in this particular case can be easily transposed by those skilled in the art to the case of cache memories comprising several cache memory levels.

[0093] Hereinafter, unless otherwise indicated, the term "word" designates both an instruction or portion of an instruction of the binary code of a process executable by the microprocessor 4 as a data or portion of data corresponding to an operand on which an instruction executed by microprocessor 4 operates.

[0094] The cache memory 6 serves as intermediate storage between the main memory 8 and the microprocessor 4. Instead of directly accessing the main memory 8 which has significant latencies, the microprocessor 4 will first search whether the word is present in the cache memory. There are then the following two cases:

[0095] - Case 1): The word is present in cache memory 6, which corresponds to the case known as a "hit" or "cache hit". In this case, the word is transferred directly to the microprocessor 4 from the cache memory 6. Memories higher than memory 6 are then not accessed to obtain this word.

[0096] - Case 2): The word is absent from the cache memory 6. This case corresponds to the one known by the English term "miss" or "cache miss". In this case, the cache memory must search a higher-ranking memory, that is to say typically in the main memory 8, for the missing word. This case is here called "cache miss". The cache miss therefore naturally leads to a longer access time to the searched word.

[0097] In this embodiment, the cache memory 6 is a W-way associative memory, better known as “W-way associative”. In this case, the integer W is greater than or equal to two and generally less than 128 or 64 or 16.

[0098] The cache memory 6 typically comprises a support 7 for recording information. The support 7 is divided into several lines Ljj of fixed length. Each line comprises a data field D;j. Each field D;j is divided into Nm words of fixed length. The lengths of a word, a field and a line are expressed by the number of bits that compose them. For example, the length of a word is typically equal to 32 bits or 64 bits. Subsequently, the description is made in the particular case where the length of a word is equal to 32 bits. Each field D;j comprises an identical number of words. For example, here, each field DLJ comprises four words. Thus, the length of the field D;j is 128 bits.

[0099] The lines of the cache memory 6 are divided into W arrays Wj, where W is an integer greater than one. Here, each array Wj contains s lines of the cache memory 6, where s is an integer equal to T / (WL), where:

[0100] - T is the size of the cache memory 6 expressed in bytes,

[0101] - L is the number of bytes per line,

[0102] - W is the array number, and

[0103] - the symbol “.” denotes the scalar multiplication operation.

[0104] These tables Wj are known by the English term "Way". For illustration purposes, the remainder of this description is given in the particular case where W is equal to four. For To simplify [Fig.l], only the tables Wi and W4 have been represented. In this figure, the lines that are not represented are symbolized by dotted lines. The index j is an identifier of the table Wj. The index j is between 1 and W. The lines Ljj are all contained in the table Wj. The tables Wj are distinct from each other, that is to say that a line of the cache memory 6 is contained in only one of these tables Wj.

[0105] The lines of the cache memory 6 are also grouped into distinct sets S i, where the index i is an identifier of the set Si among all the other sets of lines used. These sets Si are known by the English term "Set" or "Index". Each set Si contains W lines Lij with each of the lines Cj being contained in a respective table Wj. Thus, the line L^ is a line of the cache memory 6 which belongs to both the set Si and the table Wj.

[0106] Each set Si in the cache memory 6 corresponds one-to-one to an address @Si called a “row set address”. There are therefore s different row set addresses @Si here. Subsequently, the minimum number of bits required to code the address @Si of a set Si is, for example, equal to five so that s is equal to 25.

[0107] The position of a particular word in the Dij field is identified by an index "dr" which identifies the position of a word in the Cj line. The index dr is a number between 1 and Nm. Typically, the words in the same field are placed immediately behind each other.

[0108] In addition to the field D^, each line L^ includes a line label Tjj called a “tag” in English. The label Tij contains a value that makes it possible to unambiguously select the line Lij that contains the searched word from among the W lines Lij of the set Si. For this, the label Tjj is constructed from the bits of the address @r of the searched word that have not already been used to determine the address @Si of the set Si likely to contain the line L^ and to determine the index dr. For example, a hash function can be applied to these bits of the address of the searched word to obtain the label T^.

[0109] The cache memory 6 also includes an electronic management unit 14. This unit 14 is notably configured to:

[0110] - in response to a request to read a word in the cache memory 6, send the searched word to the requester if this word was found in the cache memory 6 and otherwise, trigger a cache miss, and

[0111] - in response to a request to write a word in the cache memory 6, replace the old value of this word recorded on the medium 7 by its new value and, in the event that the word to be written could not be found in the cache memory 6, trigger a cache fault.

[0112] For example, when the unit 14 triggers a cache fault, it sends a request to a higher-ranking memory, typically here the main memory 8, to trigger the loading, into the cache memory 6, of the searched word. The unit 14 then manages the recording, in a line Ljj, of the word provided in response to its request.

[0113] By way of illustration, the microprocessor 4 conforms to the RISC (“Restricted Instruction Set Computer”) architecture. The microprocessor 4 comprises, in particular, a data input / output interface 28.

[0114] The interface 28 makes it possible to read words from the memory 6 and, alternately, to write words into the memory 6. Here, to read a word, the microprocessor 4 generates and sends via the interface 28 a request to read this word. This read request includes in particular a physical or virtual address @r of the word to be read. The virtual address of a word is the address of this word in the memory space of the process executed by the microprocessor 4. This virtual address corresponds to a physical address in the main memory 8 where the searched word is recorded. Conventionally, it is a conversion module known by the acronym MMU (“Memory Management Unit”) which is responsible for converting virtual addresses into physical addresses when this becomes necessary.

[0115] The @r address includes for this purpose:

[0116] - an address @Si,r of a set Si>r of the cache memory 6 likely to contain the searched word;

[0117] - an index dr which identifies the position of the searched word in field D; j of the W lines Ljj of the set Si>r identified by the address @Su, and

[0118] - a label Tr which allows unambiguous selection, among the W lines Uj from the set Si>r corresponding to the address @Su, the line which contains the searched word if this line exists.

[0119] The label Tr is typically constructed by implementing the same algorithm as that implemented to construct each of the labels Tjj recorded in the cache memory 6. Thus, if one of the lines Uj of the set Si>r contains the searched word, its label Tjj is identical to the label Tr. This makes it possible to identify it unambiguously as being the line which contains the searched word among the W lines L^ of the set Si>r.

[0120] In this embodiment, the write and read requests received by the cache memory 200 additionally comprise:

[0121] - an identifier Idu of the process executed by the microprocessor 4 which issued this request, and

[0122] - a shared memory MP marker that indicates whether or not the searched word is shared with other processes simultaneously executed by computer 2.

[0123] Typically, the Idu identifier is a PID (“Process IDentifier”) assigned to any process executed by the microprocessor 4. For example, the identifier Idu is the process identifier known by the acronym ASID (“Address Space IDentifier”).

[0124] The MP marker can take an active state and an inactive state. In the active state, it indicates that the word to be accessed is shared between several processes simultaneously executed by the computer 2. A shared word is the same word which can be read and / or written by several different processes. In the inactive state, the MP marker indicates that the word to be read or written is only used by the process which generated the request.

[0125] A request to write a word in the memory 6 is, for example, practically identical to the read request except that it also includes a digital value Vr containing the new value of the word to be recorded in the cache memory 6.

[0126] [Fig.2] shows in more detail the unit 14 for managing the cache memory 6. Unit 14 is configured to implement the management method described in more detail with reference to [Fig.5].

[0127] The unit 14 comprises registers in which the various data contained in the read or write request received by the memory 6 are recorded. In this figure, the registers containing the label Tr, the address @Su, the index dr, the identifier Idu, the marker MP and the value Vr bear, respectively, the references Tr, @Sij, dr, Idu, MP and Vr.

[0128] The unit 14 comprises a memory 38 and a hardware generator 40 of values ​​Iwjjr for each of the indexes Iwj corresponding to the address @r received.

[0129] Typically, the memory 38 is only accessible by the components of the unit 14. Preferably, the memory 38 is a non-volatile memory. In particular, the information contained in the memory 38 cannot be read or written by processes executed by the microprocessor 4. Here, this memory 38 comprises a cryptographic key k and W indirection tables Tj. Here, each indirection table Tj is uniquely associated with a respective index, i.e. here with the index Iwj. Therefore, in this exemplary embodiment, the memory 38 comprises four tables Ti to T4 for the indexes, respectively, Iwi to Iw4. The structures of all the tables Tj are identical.

[0130] The generator 40 executes a bijective correspondence function which associates with each address @Si,r one and only one set of W values ​​Iwj r. This set of values ​​Iwj r corresponds to the set Si>r since each value Iwjr uniquely identifies one of the lines of the set Si>r.

[0131] The generator 40 receives, as input, the address @Sij. In addition, in this embodiment, it also receives as input, the label Tr, the identifier Idu and the marker MP. As output, it returns, on a respective output, each of the generated values ​​Iwj>r. For this purpose, the generator 40 has W outputs. Here, the value Iwj>r of each index Iwj is between 1 and s. The value Iwj>r therefore corresponds directly to the number of the line Ljj in table Tj

[0132] Here, the generator 40 comprises in particular for this purpose a cryptographic circuit 42 and a conversion circuit 44.

[0133] When the marker MP indicates that the word is not shared, the cryptographic circuit 42 generates four intermediate values ​​l'Wjj as a function of the address @Su, the label Tr, the identifier Idu and the key k contained in the memory 38. Conversely, when the marker MP indicates that the word is shared, the cryptographic circuit 42 generates four intermediate values ​​l'Wjj as a function of the address @Si,r and the key k but without taking into account the identifier Idu and, possibly, the label Tr. Each intermediate value l'w^ is an integer between one and s.

[0134] The circuit 44 converts each intermediate value I'Wj,r into a final value Iwj r returned to the corresponding output of the generator 40. For this, the circuit 44 uses the indirection tables Tj recorded in the memory 38. More precisely, the circuit 44 uses the intermediate value I'wj>r as a line number to select a line from the table Tj and then extracts the corresponding final value Iwj>r from the selected line.

[0135] Unit 14 also includes the following components:

[0136] - a random or pseudo-random generator 48 of integers between 1 and s,

[0137] - a comparator 56,

[0138] - an automaton 60,

[0139] - a 62 word extractor

[0140] The comparator 56 compares the received label Tr to the labels Tjj of the lines of the set Si>r selected using the address @Sij. If one of the labels T^ of the selected set Si>r corresponds to the label Tr, then a signal for selecting this line L^ as being the one containing the searched word is generated. This selection signal therefore corresponds to the case of a "hit". In the opposite case, that is to say that none of the labels T^ of the selected set Si>r corresponds to the label Tr, a cache fault signal is generated. A label T^ corresponds to the label Tr if these two labels are identical.

[0141] The selection signal is, alternately, the cache fault signal is received by the automaton 60.

[0142] In parallel with comparator 56, extractor 62 extracts from the field DLJ of the same line Lij as that currently processed by comparator 56, the word located at the position identified by the received index dr.

[0143] The automaton 60 is notably configured to:

[0144] - select the W lines Dj of the set Si>r corresponding to the address @Si,r at from the values ​​Iwj>r generated by generator 40,

[0145] - if one of the W lines Ljj selected triggers a success signal, then the automaton 60 triggers in response, in the case of a read request, the transmission of the extracted word, and, in the case of a write request, the writing of the value Vr received at the location of the word situated at the position identified by the index dr in the field DLJ of this line, and

[0146] - load from main memory 8 and save in cache memory 6 the word corresponding to the address @r contained in the received request if this word could not be found in the cache memory 6.

[0147] The structure of table Tj is shown in [Fig.3]. Table Tj has four columns and as many rows as there are possible values ​​for index Iwj. Here, it therefore has s rows numbered from 1 to s. The intersection between a column and a row forms a cell. Each cell is capable of containing a value. Thus, each row of table Tj has four cells Cx>yj, where the indices x and y are the numbers, respectively, of the row and column of table Tj. The index x varies from 1 to s and the index y varies from one to four. To simplify [Fig.3], only two rows corresponding to the row numbers, respectively, I'wj>r and I'Wj,k have been shown.

[0148] The first column of the table Tj, that is to say the one which contains all the cells C x,ij contains all the possible values ​​of the index Iwj. Here, these possible values ​​are the integer values ​​which go from one to s. Thus, each cell CXjij contains one of these values. For example, here, the cells CXjij of the lines l'Wj^ and I'wjjk contain the values, respectively, Iwj r and Iwjjk of the index Iwj.

[0149] The second column of table Tj contains all cells CXj2j. Each cell C Xj2j contains a counter CNTjj associated with the row Cj identified by the value of the index Iwj contained in the cell CXjij located on the same row.

[0150] The third column of the table Tj contains all the cells CXj3j. Each cell C Xj3jj contains a validity bit B vd associated with the line Ljj identified by the value of the index Iwj contained in the cell CXjij located on the same line. This bit Bv^j makes it possible to mark the line L^ as being valid and, alternately, invalid. Conventionally, a line L;j marked as invalid must be treated as if it contained no words. Thus, a line Ljj marked as invalid is intended to be erased and replaced as a priority by another line loaded from the main memory 8. Here, when the line L^ is valid, the bit Bv;j is equal to "1". Conversely, the bit Bv;j is equal to "0" when the line Lij is invalid.

[0151] The fourth column of table Tj contains all cells CXj4j. Each cell C Xj4j contains a dirty bit Bs^ associated with the row Lij identified by the value of the index Iwj contained in the cell CXjij located on the same row. The bit Bs^ is better known as the "dirty" bit. The bit Bs^ is used to mark this row Lij as having been modified. When a line Ljj is marked as having been modified, the field DLJ it contains is copied into the main memory 8 before, for example, this line is marked as invalid or evicted from the cache memory 6. Here, when the line Ljj has been modified, the bit Bs^ is equal to "1". Conversely, the bit Bs^j is equal to "0" when the line has not been modified.

[0152] [Fig.4] shows in more detail a possible embodiment of the circuit 42 in the case where the marker MP is in its inactive state. In this embodiment, the circuit 42 comprises a concatenation circuit 70, a permutator 72, an “Exclusive OR” logic circuit 74, four substitution circuits 76 to 79 and four “Exclusive OR” logic circuits 80 to 83.

[0153] The circuit 70 receives as input the label Tr, the address @Si,r and the identifier Idu and returns, as output, a word Mr formed by the concatenation of the bits of the label Tr, the address @Si,r and the identifier Idu. For example, here the label Tr, the address @Si,r and the identifier Idu are coded on, respectively, 39 bits, 5 bits and 16 bits. Thus, the word Mr formed comprises 60 bits.

[0154] The permutator 72 permutes the bits of the word Mr to obtain a word M'r then sends the first twenty bits M'r[0..19] of the word M'r to a first input of the circuit 74, the next twenty bits M'r[20..39] of the word M'r to a second input of the circuit 74 and the last twenty bits M'r[40..59] of the word M'r to a third input of the circuit 74.

[0155] Circuit 74 performs an “Exclusive OR” or XOR between the bits M'r[0..19], M'r[20..39] and M'r[40..59] to obtain a word M; coded on twenty bits.

[0156] The first five bits M;[0..4] are sent to an input of circuit 76, the next five bits M;[5..9] to an input of circuit 77, the next five bits M;[10..14] to an input of circuit 78 and the last five bits M;[15..19] to an input of circuit 79.

[0157] The circuits 76 to 79 substitute the bits received at input with other bits to generate four words Msi to Ms4 each transmitted on a first input, respectively, of the circuits 80 to 83. For example, each circuit 76 to 79 is a circuit known as an “S-BOX”.

[0158] Circuits 80 to 83 receive on a second input, respectively, the first five bits k[0..4], the next five bits k[5..9], the next five bits k[10..14] and the last five bits k[15..19] of the key k.

[0159] Circuits 80 to 83 each perform an “Exclusive OR” or XOR and restore on their outputs, respectively, the intermediate values ​​I'wi.r, 1^, Fw3r and I'w4r.

[0160] The operation of the computer 2 and the cache memory 6 will now be described with reference to the method of [Fig.5].

[0161] When the computer 2 is powered up, all the lines of the cache memory 6 are marked as invalid using the bit Bvij. For this, the value “0” is written in all the cells CXj3j of all the tables Tj. For example, When using calculator 2 for the first time, the numerical values ​​from 1 to s are stored, respectively, in cells CXjij of each table Tj. In other words, at the beginning of the first use of calculator 2, the value x is stored in cell Cx,ij. During subsequent uses, the contents of cells CXjij are, for example, those stored at the end of the previous use. Thus, during subsequent uses, the values ​​from 1 to s are not necessarily stored in cells Cx>ij in ascending order of indices x.

[0162] After powering up the computer 2, the execution of at least one process is triggered. The computer 2 here has the capacity to execute several processes simultaneously. For this, for example, the computer 2 executes an operating system which makes it possible to schedule in time the simultaneous execution of these different processes by the microprocessor 4. Thanks to this, all the processes are executed alternately by this same microprocessor 4. Similarly, the cache memory 6 is accessible and usable by all the processes executed simultaneously. In particular, to increase the efficiency and speed of execution of each of the processes, each of them can read and write words in any location of the support 7. In other words, the support 7 is not divided into several partitions, the use of each of these partitions being reserved for a single particular process.

[0163] The execution of several processes by a microprocessor is well known to those skilled in the art. Thus, only the accesses and management of the cache memory 6 are described in more detail below.

[0164] During a step 100, a request to read a word is received by the unit 14. This request is sent by a process executed by the microprocessor 4. This read request contains in particular the address @r of the word to be read and therefore the label Tr, the address @ Si>r and the index dr. It also contains the identifier Idu of the process which sent this request as well as the state of the marker MP.

[0165] During a step 102, the label Tr, the address @Su, the index dr, the identifier Idu and the marker MP are recorded in the registers, respectively, Tr, @Su, dr, Idu and MP of the management unit 14.

[0166] During a step 104, the generator 40 then generates the four values ​​Iwi>r, Iw2>r, Iw3>r and Iw4>r of the indexes, respectively, Iwb Iw2, Iw3 and Iw4.

[0167] For this, during an operation 106, the circuit 42 checks whether the received MP marker is in its inactive state. If so, the method continues with an operation 108. If not, the method continues with an operation 110.

[0168] During operation 108, circuit 42 constructs four intermediate values ​​l'wij, I'w2>r, Fw^ and I'w4j as described with reference to [Fig.4].

[0169] Operation 110 is identical to operation 108 except that the bits of the identifier Idu are replaced by a predetermined constant value that is identical for all the processes executed by computer 2. For example, the bits of the identifier Idu are all set to zero. In this case, the generated intermediate values ​​I'wi.r, Fw^ I'w3r and I'w4,r do not vary according to the identifier Idu. Therefore, if two executed processes have the same address space, while the request containing the address @r is issued by one or the other of these processes, the intermediate values ​​Fw^, l'w 2>r, I'w3r and I'w4r are identical. Therefore, as will be understood from reading the rest of this description, the set Si>r is the same for these two processes since the tables Tj are the same for all processes. This therefore allows these two processes to share a word stored in the cache memory 6.

[0170] At the end of operation 108 or at the end of operation 110, during an operation 112, the circuit 44 converts the intermediate values ​​Tw^, I'w2,r, I'w3,r and I'w4>r generated by the circuit 42 into final values ​​Iwi.r, Iw2>r, Iw3>r and Iw4>r using for this the tables Ti to T4.

[0171] The operation of the circuit 44 is explained in the particular case of the conversion of an intermediate value l'wjj into a final value Iwj>r using the table Tj. What is described in this particular case is applied for each of the values ​​of the index "j" between 1 and 4.

[0172] The circuit 44 selects, in the table Tj, the cell CXjij which is located on the line whose number is equal to the value l'Wjj. The final value Iwj>r is then taken equal to the value contained in the cell CXjij thus selected. For example, referring to the contents of the table Tj shown in [Fig.3], the cell CXjij thus selected contains the final value Iwj>r.

[0173] Then, during a step 120, the automaton 60 selects from the support 7, the set Si>r of W lines Cj located at the address @Sij. This set Si>r is formed by the W lines identified by the W final values ​​Iwj r obtained at the end of step 104. It is recalled that each value Iwj r of the index Iwj points to a respective line in the table Tj. Typically, the line identified by the index Iwj is the one whose line number is equal to the value Iwj>r.

[0174] During a step 122, the comparator 56 processes one after the other the W lines selected at the end of step 120. Successively, for each of the lines L^j thus selected, the comparator 56 compares the label Tjj of this line with the label Tr received. The comparator 56 transmits a success signal (“hit”) to the automaton 60 only if, for the line Cj currently being processed, the labels Tjj and Tr are identical. In all other cases, the comparator 56 transmits a no-match signal to the automaton 60.

[0175] In parallel, during a step 124, the extractor 62 reads, in the field Dij of the line Dj currently processed by the comparator 56, the word located at the position identified by the index dr received.

[0176] In response to a success signal, during a step 126, the automaton 60 transmits to the microprocessor 4 the word extracted during step 124 and the method returns to step 100 to process the next read request.

[0177] If the comparator 56 has generated a signal of no correspondence for the W lines Ljj processed, the automaton 60 triggers a cache fault. The method then continues with a step 130 of supplying the searched word from a higher-ranking memory.

[0178] Step 130 begins with an operation 132 of selecting the line to be evicted from among the W current lines of the set Si>r. For this, the automaton 60 selects as a priority a line from the set Si>r whose bit Bv^ indicates that it is invalid. For this purpose, for each line Ljj of the set Si>r, the automaton 60 reads the bit Bv^ associated with this line Lij by the table Tj. More precisely, the automaton 60 reads the bit Bv;j contained in the cell CXj3j of the line of the table Tj whose cell CXjij contains the value Iwj>r generated during step 104.

[0179] If only one line Lij of the set Si>r is associated with a bit Bvjj which indicates that this line is invalid, then this line is selected to be evicted. Otherwise, if several lines of the set Si>r are associated with bits Bvjj which indicate that they are invalid, then any one of these lines is selected. Finally, if all the lines of the set Si>r are valid, that is to say they are all associated with validity bits which indicate that they are valid, then any one of these lines is selected to be evicted.

[0180] Then, during an operation 134, the automaton 60 checks the state of the “dirty” bit associated with the selected line to be evicted. For this purpose, if the selected line to be evicted is the line Lij, the automaton 60 reads the bit Bs;j associated with this line Lij by the table Tj. More precisely, the automaton 60 reads the bit Bs;j contained in the cell CXj4j of the line of the table Tj whose cell CXjij contains the value Iwj r generated during the step 104, the index j being the index of the table Wj which contains the line Lij selected during the operation 132.

[0181] If during operation 134, the bit Bs;j indicates that this line has been modified since its recording on the medium 7, then, during an operation 136, the content of its field Dij is saved in a higher rank memory, that is to say here in memory 8.

[0182] Then, directly after operation 134 if the bit Bs;j of the line to be evicted is equal to zero or at the end of operation 136, during an operation 140, the automaton 60 compares the value of the counter CNT^ to a predetermined threshold SA. The counter CNTij is that associated with the line Lij to be evicted by the table Tj. For this, the automaton 60 reads the value contained in the cell Cx>2j of the line of the table Tj whose cell Cx>ij contains the value Iwj>r generated during step 104, the index j being the index of the table Wj which contains the line Lij selected during operation 132.

[0183] If the value of the counter CNT;j is lower than the threshold SA, then, during an operation 142, the line Ljj to be evicted is replaced, on the support 7, by a new line loaded from the higher-ranking memory and containing the searched word. For this, the new line is recorded on the support 7 in place of the line to be evicted.

[0184] Then, during an operation 144, the counter CNT;j is incremented by a predetermined step, for example, equal to one. The bits Bv;j and Bs;j are also set, respectively, to “1” and “0”.

[0185] If the value of the counter CNTij is greater than or equal to the threshold SA, at the end of operation 140, the method continues with an operation 150.

[0186] During operation 150, a new row of the table Wj, different from the row L^ to be evicted, is selected. For example, for this purpose, the generator 48 is used to randomly draw a number between 1 and s and different from the current value Iwj r of the index Iwj. Subsequently, the value thus drawn is noted Iwjjk. For example, as illustrated in [Fig.3], this value Iwjjk corresponds to a row Lkj of the table Wj, where the value of the index k is different from the value of the index i. The row Lkj is associated, by the table Tj, with the counter CNTkj and with the bits Bvkj and Bskj.

[0187] During an operation 152, the automaton 60 permutes, in the table Tj, the contents of the lines containing the values ​​Iwj>r and Iwjjk of the index Iwj. During the operation 152, only these two lines of the table Tj are permuted and all the other indirection tables remain unchanged. At the end of the operation 152, the cells of the table Tj located on the line whose number is equal to I'Wj,r contain, respectively, the values ​​Iwjjk, CNTkj, Bvkj and Bskj. The cells of the table Tj located on the line whose number is equal to I'Wjjk contain, respectively, the values ​​Iwjr, CNTij, Bv;j and Bs;j. So, following this modification of the table Tj, now, for a read request containing the same address @r, the same identifier Idu and the same marker MP, the value of the index Iwj is equal to Iwjjk and is no longer equal to Iwjr. In other words, after operation 152, the set Si>r contains the row Lkj instead of the row Ljj.

[0188] Then, during an operation 154, the counters CNTkj and CNTij are reset. For this, here, they are reset to zero in the table Tj. In addition, the validity bit Bv;j is set to zero to indicate that the line L;j is now invalid.

[0189] Finally, during an operation 156, the line Lkj to be evicted is replaced, on the support 7, by a new line loaded from the higher-ranking memory and containing the searched word. For this, if the bit Bskj associated with the line Lkj is equal to “1”, then the content of the field Dkj is first saved in the higher-ranking memory. Then, the new line is recorded on the support 7 in place of the line Lkj. The bits Bvkj and Bskj are then set, respectively, to “1” and “0”.

[0190] At the end of step 130, during a step 160, the searched word is read in the cache memory from the new line loaded during operation 142 or 156.

[0191] In the case of a request to write a word in the cache memory 6, everything previously described applies except that, instead of reading the word searched in the cache memory, the value Vr received is written in the word searched.

[0192] Chapter III: Variants

[0193] Method variants:

[0194] During operation 132, other methods of selecting the line to be evicted are possible. For example, in a particularly simple variant, the line to be evicted is chosen without taking into account the state of the validity bits Bv^. For example, the line to be evicted is chosen randomly or pseudo-randomly from among the W lines of the set Si>r. In this case, the validity bit Bv;j can be omitted.

[0195] The permutation of two lines of the table Tj during the execution of the process can be triggered differently. In particular, the use of the counters CNT^ can be omitted. For example, as a variant, the permutation of the two values ​​Iwij and Iwkjj of the index Iwj in the table Tj is automatically triggered randomly in response to a cache miss. For example, operation 140 is replaced by an operation during which a number is randomly drawn. If this number is greater than or equal to the threshold SA, operations 150, 152 and 156 are executed. Otherwise, operation 142 is executed. In this case, operation 144 of incrementing the counter CNTij and operation 154 of resetting the counters are omitted. In another embodiment, unit 14 comprises a timer which counts down a duration T44.Each time the duration T44 has elapsed, in response to the next cache miss, the swapping of the two rows of the table Tj is triggered. Thus, in this case, the time interval between two swaps of two rows of the tables Tj is independent of the number of cache misses. In another embodiment, it is an event other than a cache miss that is counted to trigger the swapping of two rows of the table Tj. For example, the execution of operations 150 and 152 is systematically triggered after a predetermined number of "hits" or on the basis of any other criterion. In another simplified variant, the execution of operations 150, 152 to 156 is triggered each time a cache miss occurs. In this case, operations 140, 142, 144 and 154 are omitted.

[0196] During operations 142 and 156 instead of copying only the line of the higher-ranking memory which contains the searched word into the cache memory 6, W lines are copied from the higher-ranking memory into the W lines of the set Si>r. Typically, W lines are adjacent, in the higher-ranking memory, to the line which contains the searched word.

[0197] During operation 150, the selection of the new line Lkjj in the table Tj is not necessarily carried out randomly or pseudo-randomly. For example, in alternatively, the new row is selected by implementing a deterministic function which, to each value of an input variable, associates a determined value Iwkj respective of the index Iwj. The value of the input variable is determined from one or more values ​​known at the time the new row is to be selected. For example, it may be a value constructed from the values ​​contained in the received read or write request. However, other values ​​known to the unit 14 than those contained in the read or write request may be used for this.

[0198] During operation 144, other values ​​are possible for the increment step of the counter CNT;j. In particular, the increment step can also be negative. In this case, the initial value of the counter CNTij assigned to this counter during operation 154 is a value greater than the threshold SA.

[0199] Variants of the generator of index values ​​Iwj:

[0200] The label Tr can be constructed both from the physical address @rr of the searched word and from the virtual address @rv of this searched word. Indeed, it is always possible to convert a physical address into a virtual address and vice versa. This is typically the function of the memory management unit known by the acronym MMU (“Memory Management Unit”). Thus, if at the time when the unit 14 receives the request to read or write a word, the physical address @rr is known, then the unit 14 uses this address @rr to extract the address @Su, the label Tr and the index dr. This situation is encountered almost systematically if the cache memory 6 is an L2 cache memory or higher. In the case where the cache memory 6 is an L1 cache memory, it may be that at the time when the unit 14 receives this request, only the virtual address @rv is available.In this case, the generator 40 uses the address @rv to extract the label Tr and the address @Sij. Thus, in this case, the values ​​Iwjr are generated from the virtual address @rv and not from the physical address @rr. Along the way, the physical address @rr becomes available and, in particular, steps 122, 124 and 126 are carried out using this physical address and not the virtual address of the word to be read or written.

[0201] The generator 40 may take into account other additional information contained in the read or write request to generate the values ​​of the indexes Iw j. For example, the generator may additionally use the index dr.

[0202] Conversely, the generator 40 can also take into account less information than that described previously to generate the values ​​of the indexes Iwj. For example, systematically, the label Tr is not taken into account to generate the values ​​Iwjjr of the indexes Iwj. In another very simplified variant, the process identifiers Idu are omitted and are never used to construct the values ​​Iwjjr of the row indexes Iwj.

[0203] In step 110, to share the searched word between several processes, if necessary, the label Tr is replaced by a constant and identical value for all processes. This may be necessary if the label Tr is extracted from the virtual address @rv and not from the physical address @rr of the searched word.

[0204] In another embodiment, the shared memory marker MP is omitted. In this case, it is not possible to share a word stored in the cache memory between several processes simultaneously executed by the computer. For this, typically, the identifier Idu of each executed process is systematically used to generate the values ​​of the indexes Iwj.

[0205] Other embodiments of the cryptographic circuit 42 are possible. For example, the circuit 42 may perform a more complex cryptographic function than that previously described to generate the intermediate values ​​l'Wjj. For example, the cryptographic function performed by the circuit 42 may be identical to the IDF function used in the Scattercache solution. Conversely, preferably, the cryptographic function may also be simpler than that previously described. For example, the permutator 72 or the substitution circuits 76 to 79 are omitted.

[0206] The key k can also be omitted. In this case, the generated Iwjjr values ​​are independent of this key k.

[0207] In a very simplified variant, the cryptographic circuit 42 is omitted. For example, in this case, the intermediate values ​​I'wj>r are all taken equal to the address @Sij-

[0208] The number of indirection tables used is not necessarily equal to W. For example, to save memory, as a variant, the number of indirection tables is less than W. In this case, several Iwj indexes are associated with the same indirection table Tk common to these Iwj indexes. Therefore, the same table Tk is used, for several different Iwj indexes, to transform the intermediate value I'Wj r of this Iwj index into a corresponding final value Iwj r. This still makes it possible to obtain different Iwjr values ​​for these different Iwj indexes because the intermediate I'Wj r values ​​are different from each other. In an extreme case, a single indirection table associated with all the Iwj indexes is used.

[0209] Other variants:

[0210] Alternatively, the counters CNT;j and / or the “dirty” bits Bs^ and / or the validity bits Bv^ are recorded directly on the medium 7 and not in the indirection tables Tj. Typically, in this case, the counter CNTij, the bit Bsij and the bit Bvij associated with the line Lij are recorded directly in this line on the medium 7 at predefined locations and distinct from the word(s) contained in this same line Lij.

[0211] Here, the expressions “validity bit” and “dirty bit” each designate a piece of information encodable using a single bit. However, alternatively, although the information is encodable using a single bit, it is possible to encode it using several bits.

[0212] Alternatively, the value of the threshold SA is dynamically adjusted by the computer during the execution of the process. For example, the computer notes the current cache miss rate. If the current cache miss rate crosses a threshold, then the value of the threshold SA is lowered to swap two values ​​from the indirection table more frequently.

[0213] The cache memory can be divided into different levels of cache memory traditionally called "L1 cache", "L2 cache", "L3 cache", etc. The access times to these different levels increase going from the L1 cache to the L3 cache. In addition, these different levels of cache memory are not necessarily implemented on the same chip ("die" in English). For example, the L1 cache can be implemented inside the microprocessor 4 while the higher levels are implemented outside the microprocessor 4. The methods for managing a cache memory described here are applicable to each of these levels of cache memory. Preferably, the methods described here are applied to each of these levels.

[0214] The number W of table Wj can be equal to one, two or three or be greater than four or six.

[0215] The teaching given here also applies to the cases of direct mapped cache memories. In this case, the number W is equal to one and the address @Si,r corresponds to a single line of the cache memory.

[0216] The mass memory may be located outside the computer and connected to this computer by a bus or an information transmission network. Similarly, the main memory may also be mechanically located outside the computer and connected to this computer by a bus or an information transmission network.

[0217] What has been described here applies to other word and line lengths.

[0218] In another embodiment, the index dr is omitted in the request to read a word in the cache memory. In this case, in the event of a match between the label Tr and one of the labels Tjj, the cache memory 6 sends the complete field D ij to the microprocessor 4. It is then the microprocessor 4 which itself proceeds to extract the desired word in the field D;j received.

[0219] Instead of comprising a single microprocessor, the electronic computer may comprise several microprocessors, each capable of accessing the cache memory 6. In this case, each process executed in parallel with the others is, for example, executed by its own microprocessor. What has been described here in the particular case where the different processes are executed, in parallel, by the same microprocessor 4 works in the same way in the case of such an electronic computer equipped with several microprocessors.

[0220] Several of the embodiments described herein may be combined with each other to obtain a new embodiment.

[0221] Chapter III: Advantages of the embodiments

[0222] The fact of using at least one indirection table Tj to generate the values ​​Iwjr of the indexes Iwj and of permuting, in response to a cache fault, only two values ​​of this indirection table makes it possible to modify, little by little and during the execution of the process, the spatial distribution of the lines of the cache memory 6 used by this process. Unlike a change of the key k or of the identifier SDID in the Scattercache solution, the spatial randomization of the lines of the cache memory 6 used by the process is not static and evolves little by little. Thus, the slowdown in the execution of the process due to a very large number of cache faults following the change of the key k or of the identifier SDID does not occur. The method for managing a cache memory described here also makes it possible to simplify the IDF function described in the Scattercache solution without reducing the security of the method.Indeed, in the method described here, the spatial randomization is already obtained by the permutations of the values ​​in the indirection tables Tj. Therefore, it is not necessary to use a complicated cryptographic function to implement the circuit 42. The method described here also makes it possible to retain the advantages of the method described in the Scattercache solution. In particular, in the case of an associative cache memory, where W is greater than one, the lines corresponding to the same set address @Si,r are not located next to each other in the cache memory and are not necessarily located at the same location in each of the tables Wj. Thus, this makes it possible to maintain good spatial randomization of these lines inside the cache memory while adding temporal randomization. Here, "temporal randomization" refers to frequently changing the spatial randomization.

[0223] Triggering the permutation of the two values ​​Iwj r and Iwjjk of the index Iwj in the indirection table Tj only when the value of the counter CNT;j associated with the line to be evicted crosses the threshold SA, simply makes it possible to adjust the frequency at which the permutations take place during the execution of the process. Indeed, for this, it is sufficient to modify the value of the threshold SA.

[0224] Recording the counter CNTij, the bit Bsjj or the validity bit Bvjj in the indirection table Tj rather than on the support 7, allows faster access to this information which accelerates the execution of the process.

[0225] The use of the process identifier Idu to generate the values ​​of the indexes Iwj, makes it possible to use lines of the cache memory which differ depending on the process. Thus, it is difficult for an attacking process executed by the computer 2 to access simply to the lines used by another concurrently running process. Moreover, to achieve this result, it is not necessary to partition the cache memory between the different running processes.

[0226] Not taking into account the process identifier Idu to generate the values ​​of the W index Iwj when the shared memory marker MP is in the active state, makes it possible to share a word stored in the cache memory between several processes.

[0227] The random or pseudo-random selection of the new line Lk>j makes the location of this new line in the cache memory more unpredictable. This therefore makes the identification of the cache memory lines used by an attacked process more complicated.

[0228] The fact of systematically switching the validity bit Bv;j into the “invalid” state after the line L^ has been replaced by the line Lk>j, makes it possible to evict as a priority those lines which are no longer used and therefore to limit the number of times where a line must be saved in a higher-ranking memory.

[0229] Using the key k stored in the memory 38 of the cache memory management unit 14 to select a cell CXjij in the table Tj makes it possible to reinforce the robustness of the method. Indeed, the key k is not known to any of the processes executed by the computer 2 so that it is very difficult to predict the location where the words are stored in the cache memory 6. In addition, the key k is stored in a memory 38 which is not accessible by the processes executed.

Claims

1. Claims Method for managing a cache memory of an electronic calculator, this method comprising the following steps during the execution by this calculator of a process which must process a word: a) receiving (100) a request containing an address of the word to be read or written, this address comprising: - a received line label, - a received set address, this received set address belonging to a first set of s different values, where the number s is an integer greater than two, then b) generating (104), as a function of the set address received in step a), a first respective value for each row index of a group of W different row indices, where W is a predetermined integer greater than or equal to one, each row index pointing to a respective array of s different rows of the cache memory and its value uniquely identifying a single row of the array to which it points, each row identified by the first value of a row index comprising a pre-recorded row label, then c) comparing (122) the received line label to the line labels of the lines identified by the first values ​​of the W line indices generated during step b), to determine whether one of these line labels corresponds to the received line label, d) when none of the line labels compared in step c) corresponds to the received line label, triggering a cache fault and providing the word from a higher-ranking memory, and when, on the contrary, one of the line labels compared in step c) corresponds to the received line label, reading (124) or writing in the cache memory the word inside the line containing the line label which corresponds to the received line label, characterized in that: - step b) comprises, for each of the W row indexes, the selection (112), as a function of the set address received during step a), of a first cell in a first column of a pre-recorded indirection table associated with this row index and the use, as the first value generated for this row index, of the value contained in this first cell, - during step d), in response to the triggering of a cache fault, the method comprises the following operations: dl) recording (156) the word supplied from the higher-ranking memory in a new row identified by a second value of the row index which points to the table containing this new row, this second value being different from the first value of this row index generated during step b) and being contained in a second cell of the first column of the indirection table associated with this row index, this second cell being different from the first cell, and d2) permuting (152), in the first column of the indirection table associated with the row index which points to the table containing the new row, only the values ​​contained in the first and second cells so that after this permutation the first cell contains the second value and the second cell contains the first value.

2. Method according to claim 1, in which, during step d), in response to the triggering of a cache fault, the method comprises: - the selection (132) of a line to be evicted from among the W lines identified by the first values ​​of the W line indexes generated during step b), then - the comparison (140) of a counter associated with the selected line to be evicted, with a predetermined threshold, and - when it results from this comparison that the value of this counter has crossed the predetermined threshold, the execution of operations dl) and d2) and the reinitialization (154) of this counter and, conversely, when it results from this comparison that the value of this counter has not yet crossed the predetermined threshold, the recording (142) of the word supplied from the higher-ranking memory, in the selected line to be evicted and the incrementation (144) of the counter associated with this line to be evicted.

3. The method of claim 2, wherein the counter is stored in a second column of the indirection table associated with the row index that points to the table containing the row to be evicted.

4. Method according to any one of the preceding claims, in which the method comprises: - using a dirty bit associated with each line of the cache memory to determine whether, before evicting this line from the cache memory, it is first necessary to save the word or words contained in this line in a higher-ranking memory, and - recording (156) the dirty bit associated with each line of the cache memory in a third column of the indirection table associated with the line index which points to the table containing this line.

5. A method according to any preceding claim, wherein the method comprises: - using a validity bit associated with each line of the cache memory to determine whether that line should be selected as a priority for eviction from the cache memory, and - recording (154, 156) the validity bit associated with each line of the cache memory in a fourth column of the indirection table associated with the line index that points to the table containing that line.

6. Method according to any one of the preceding claims, in which: - during step a), the received request also comprises a received process identifier which distinguishes the process which issued this request from all the other processes simultaneously executed by the electronic computer, - during step b), the first values ​​of the W line indexes are also generated as a function of the process identifier received during step a).

7. Method according to claim 6, in which - during step a), the received request also comprises a shared memory marker which indicates whether or not the word to be read or written is shared with other processes simultaneously executed by the electronic computer, and - during step b), when the shared memory marker indicates that the word to be read or written is not shared with other processes simultaneously executed by the electronic computer, the first values ​​of the W line indexes are also generated according to the process identifier received during step a) and, otherwise, when the shared memory marker indicates that the word to be read or written is shared with other processes simultaneously executed by the electronic computer, the first values ​​of the W line indexes are generated without taking into account the process identifier received during step a).

8. A method according to any preceding claim, wherein operation dl) comprises random or pseudo-selection randomization of the new line among the lines of a table different from the line identified by the first value of the line index that points to that table.

9. Method according to any one of the preceding claims, in which the method comprises: - using a validity bit associated with each line of the cache memory to determine whether this line must be selected as a priority to be evicted from the cache memory, this validity bit being switchable between: - an “invalid” state where it indicates that this line must be selected as a priority to be evicted from the cache memory, and - a “valid” state where it indicates that this line must not be selected as a priority to be evicted from the cache memory, - in response to the execution of operation d2), the validity bit associated with the line of the cache memory identified by the first value of the line index which points to the table containing the new line, is systematically set (154) in the “invalid” state.

10. A method according to any preceding claim, wherein W is greater than or equal to two.

11. The method of claim 10, wherein each row index is associated with its own indirection table.

12. Method according to any one of the preceding claims, in which step b) comprises for each row index: - the construction (108, 110) of an intermediate value of this row index from the set address received during step a) and a secret cryptographic key contained in a non-volatile memory inaccessible by the processes executed by the computer, then - the selection (112), as a function of the set address received during step a), of a first cell in a first column of the pre-recorded indirection table associated with this row index, consists of selecting the cell of this indirection table which is located on the row of this indirection table whose index is equal to the intermediate value constructed for this row index.

13. Hardware unit for managing a cache memory of an electronic computer, this unit being configured to carry out the following steps during the execution by this computer of a process which must process a word: a) the reception of a request containing an address of the word to be read or write, this address including: - a received line label, - a received set address, this received set address belonging to a first set of s different values, where the number s is an integer greater than two, then b) generating, based on the set address received in step a), a respective first value for each row index of a group of W different row indices, where W is a predetermined integer greater than or equal to one, each row index pointing to a respective array of s different rows of the cache memory and its value uniquely identifying a single row of the array to which it points, each row identified by the first value of a row index having a pre-recorded row label, then c) comparing the received line label to the line labels of the lines identified by the first values ​​of the W line indices generated in step b), to determine whether one of these line labels matches the received line label, d) when none of the line labels compared in step c) corresponds to the received line label, triggering a cache fault and providing the word from a higher-ranking memory, and when, on the contrary, one of the line labels compared in step c) corresponds to the received line label, reading or writing in the cache memory the word inside the line containing the line label which corresponds to the received line label, characterized in that the management hardware unit is also configured to: - during step b), for each of the W row indexes, selecting, as a function of the set address received during step a), a first cell in a first column of a pre-recorded indirection table associated with this row index and using, as the first value generated for this row index, the value contained in this first cell, - in step d), in response to the triggering of a cache fault, perform the following operations: dl) storing the word supplied from the higher-ranking memory in a new line identified by a second value of the line index that points to the array containing this new line, this second value being different from the first value of this index of line generated during step b) and being contained in a second cell of the first column of the indirection table associated with this line index, this second cell being different from the first cell, and d2) permute, in the first column of the indirection table associated with the row index that points to the table containing the new row, only values ​​contained in the first and second cells so that after this permutation the first cell contains the second value and the second cell contains the first value.

Images