Cache Eviction for Secure Process Information Leakage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In data processing systems, sensitive information can leak between processes sharing a cache, as untrusted processes can derive access patterns from secure processes, compromising security, especially in cryptographic systems, and existing solutions incur significant performance or power overhead.
Innovation Solution
The method involves evicting information from cache locations that may be accessed by sensitive processes before commencing processing, ensuring that access behavior cannot be derived by untrusted processes, and pre-loading required information to minimize performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If processes share a cache to improve performance, then processing speed increases, but information leakage between secure and untrusted processes occurs
Solution Approach 1:
The patent applies preliminary action by evicting cache data before the sensitive cryptographic process executes. Specifically, before entering the security critical section, the system pre-evicts potential cache lines that might be accessed during cryptographic operations. This proactive eviction prevents information leakage by ensuring that when the cryptographic process runs, it cannot access or have its access patterns observed through previously cached data from untrusted processes.
2Reliability
If cache is flushed on switching between secure and non-secure domains to prevent information leakage, then security improves, but performance and power consumption deteriorate
Solution Approach 1:
The patent applies local quality by selectively evicting only specific cache lines that are relevant to the security critical section, rather than flushing the entire cache. The system identifies and evicts only those cache lines that the cryptographic process might access, based on analysis of the security critical section's memory access patterns. This localized approach maintains security by preventing information leakage through targeted eviction, while preserving performance by leaving other cache data intact for quick access.
3Reliability
If cache is divided with static allocation to domains to improve security, then information leakage is reduced, but cache utilization and performance deteriorate
Solution Approach 1:
The patent applies dynamics by making the cache eviction process dynamic and adaptive rather than static. The system dynamically determines which cache lines to evict based on the specific security critical section being executed, using handler routines that analyze the upcoming cryptographic operations and evict only the relevant cache lines. This dynamic approach allows the cache to be shared between secure and untrusted processes while maintaining security, optimizing cache utilization by evicting only what is necessary rather than allocating cache statically.
4Reliability
If lookup tables are permanently stored in tightly coupled memory to improve security, then information leakage is prevented, but memory space is consumed
Solution Approach 1:
The patent applies preliminary action by pre-loading lookup tables into the cache before the cryptographic process executes, rather than permanently storing them in tightly coupled memory. The handler routine identifies which lookup tables are needed for the upcoming security critical section and pre-loads them into the cache, then evicts these same lines before execution to prevent information leakage. This approach allows the system to use the limited tightly coupled memory space for other purposes while still providing fast access to lookup tables when needed, preventing information leakage through the cache eviction mechanism.
Data Source
AI summary
A method of impeding leakage of cache access behavioral information of a section of a sensitive process to an untrusted process, said sensitive and untrusted processes being performed by a processor within a data processing apparatus, said data processing apparatus further comprising at least one cache operable to store information required by said processor while performing said sensitive and untrusted processes, the method comprising the steps of prior to commencing processing of a section of said sensitive process by said processor, evicting information stored in locations of said at least one cache which may otherwise be evicted by said sensitive process loading information that may be required by said section of said sensitive process in said at least one cache; commencing processing of said section of said sensitive process by said processor; switching said processor during processing of said section of said sensitive process to said untrusted process in response to a switching request; on switching back to said section of said sensitive process from said untrusted process, evicting information stored in locations of said at least one cache which may otherwise be evicted by said sensitive process loading information that may be required by said section of said sensitive process in said at least one cache prior to recommencing processing of said section of said sensitive process.