Cache Memory Randomization for Side Channel Attack Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cache memory management systems are vulnerable to side channel attacks, which exploit variations in access time to reveal secret information or modify process operations, leading to performance deterioration when using existing defense mechanisms like partitioning.
Innovation Solution
A method and system for managing cache memory that involves generating random values for each process, transforming cache addresses using these random values, and dynamically partitioning the cache memory by associating each random value with an identifier stored in a history table, thereby enhancing security while maintaining performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If cache memory is used to store temporary data for fast processor access, then processor speed is improved, but security against side channel attacks deteriorates
Solution Approach 1:
A randomization layer is introduced as an intermediary between the processor and cache memory. This layer transforms cache addresses using random values stored in a history table, preventing attackers from directly observing and exploiting cache access patterns while maintaining fast processor access to cached data
Solution Approach 2:
The cache address parameter is dynamically transformed by applying random values from the history table. This changes the observable cache address parameter without affecting the actual data access functionality, thereby preventing side channel attacks that rely on monitoring cache access patterns
2Object-affected harmful factors
If cache partitioning is implemented to prevent side channel attacks, then security is improved, but performance deteriorates
Solution Approach 1:
Instead of static cache partitioning, the system uses dynamic address randomization where cache addresses are transformed using random values from the history table. This dynamic approach provides security without the performance penalty of fixed partitions, as the randomization occurs transparently during address translation
Solution Approach 2:
The history table acts as an intermediary that stores random values and performs address transformation. This mediator layer provides security functionality without requiring physical cache partitioning, thereby maintaining cache access performance while preventing side channel attacks
3Object-affected harmful factors
If random values are generated and stored for each process, then security against tracking attacks is improved, but device complexity increases
Solution Approach 1:
The history table serves multiple functions: storing random values for address randomization, tracking process identifiers, and managing cache coherence. This multi-functionality reduces the need for separate security mechanisms, thereby limiting complexity increase while providing comprehensive protection against process tracking attacks
4Object-affected harmful factors
If cache address transformation is applied, then access pattern obscuration is improved, but access time increases
Solution Approach 1:
Random values are pre-generated and stored in the history table before cache access operations. This preliminary action eliminates the need for complex real-time randomization during cache access, thereby obscuring access patterns while minimizing additional access time
Data Source
AI summary
A management system for managing a cache memory including a randomization module configured for generating a random value for each process of accessing the cache memory, and for transforming addresses of the cache memory with said random value into randomized addresses, a history table configured to store therein on each line an identification pair associating a random value corresponding to an access process, with an identifier of the corresponding access process, so forming identification pairs that are operative to dynamically partition the cache memory while registering the access to the cache memory, and a state machine configured to manage each process of accessing the cache memory according to the identification pairs stored in the history table.