Obscuring Code Paths via Cache Line Interleaving

Solution Overview

Problem

Virtualized computing environments face challenges in preventing timing side-channel attacks, where malicious applications exploit shared memory pages to monitor target processes or applications by measuring cache residency and access times, making it difficult to fully disable page de-duplication without significant performance and resource costs.

Innovation Solution

The techniques involve obscuring accesses to critical code paths and sensitive data by interleaving instructions from multiple code paths into the same cache lines and using non-standard address translation functions to scramble data, thereby preventing attackers from determining which code paths are taken or which data elements are accessed.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If page de-duplication is disabled entirely to prevent timing side-channel attacks, then security against timing attacks is improved, but memory usage increases and application startup performance deteriorates

Engineering Contradiction:

Improvesecurity against timing attacksVSAvoidapplication startup performance

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent segments the memory system into two distinct parts: a shared page cache that enables page de-duplication for improved performance, and a protected cache region that isolates critical code paths from timing attacks. This segmentation allows the system to maintain page sharing benefits while preventing attackers from inferring sensitive information through cache timing measurements.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces a protected cache region as an intermediary layer between the shared page cache and the critical code paths. This intermediary structure allows page de-duplication to function for general pages while creating a security buffer that prevents timing attacks from reaching the sensitive execution paths, thus resolving the contradiction between security and performance.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If page de-duplication is disabled entirely to prevent timing side-channel attacks, then security against timing attacks is improved, but memory resource consumption increases

Engineering Contradiction:

Improvesecurity against timing attacksVSAvoidmemory resource consumption

Core Design Contradiction:

ReliabilityVSQuantity of substance

Solution Approach 1:

The patent segments the memory system into two distinct parts: a shared page cache that enables page de-duplication for improved performance, and a protected cache region that isolates critical code paths from timing attacks. This segmentation allows the system to maintain page sharing benefits while preventing attackers from inferring sensitive information through cache timing measurements.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies local quality by providing different cache sharing characteristics to different parts of the system: shared pages retain their de-duplication benefits for non-critical pages, while only the specific cache lines containing critical code paths are protected from sharing. This localized protection approach minimizes memory resource consumption while maintaining security.

Inventive Principle:

Principle #3Local quality

3Reliability

If critical code paths are protected from sharing to prevent timing attacks, then security is improved, but the complexity of memory management increases

Engineering Contradiction:

Improvesecurity against timing attacksVSAvoidmemory management complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent introduces a protected cache region as an intermediary layer between the shared page cache and the critical code paths. This intermediary structure allows page de-duplication to function for general pages while creating a security buffer that prevents timing attacks from reaching the sensitive execution paths, thus resolving the contradiction between security and complexity.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system employs self-service mechanisms where the protected cache region automatically manages the isolation of critical code paths without requiring complex external memory management intervention. The structure itself provides the security function, reducing the burden on memory management systems while maintaining both security and simplicity.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS10311229B1Mitigating timing side-channel attacks by obscuring alternatives in code

Publication Date: 2019.06.04 AMAZON TECH INC

AI summary

In a virtualization environment, a guest process may protect itself from potential timing side-channel attacks by other guest processes on the same host machine by taking steps to obscure accesses to alternative critical code paths (e.g., alternative paths within cryptographic functions whose selection at runtime is dependent on secret data) that have been designated as potential targets of such attacks. This may include interleaving instructions from multiple alternative code paths so that they land in the same cache lines (e.g., so that all code paths pass through the same set of cache lines). The different code paths may be allocated the same or different numbers of bytes per cache line, and unused allocated locations may be filled with NOPs. Chunks of code for a given code path that fall on different cache lines may be linked using local jumps. Some code chunks may span the boundaries between two cache lines.