Cache Memory Obfuscation for Side-Channel Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cache side-channel attacks, such as timing attacks, can reveal security-relevant data like cryptographic keys by analyzing cache access patterns in modern microprocessors, as the assignment of main memory addresses to cache positions shows limited variability, allowing attackers to reconstruct security data.
Innovation Solution
A method and system that obfuscate cache set addresses using obfuscation parameters and identifiers, generating modified cache set addresses through permutation functions like XOR operations, and reorganizing cache memory to scatter data across multiple cache sets, making it difficult for attackers to analyze cache content effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If data is stored in cache memory to accelerate access, then memory access speed is improved, but security is worsened due to cache side-channel attacks
Solution Approach 1:
The patent divides the cache memory into multiple cache sets and further segments data placement by mapping different cache lines to different cache sets based on obfuscated address transformations. This segmentation prevents attackers from correlating cache access patterns with cryptographic data, while maintaining fast access through the segmented cache structure.
Solution Approach 2:
The patent introduces an intermediary transformation layer between the memory address and the cache set address. This intermediary uses obfuscation parameters and permutation functions to transform addresses before cache mapping, creating a security buffer that prevents direct analysis of cache content while preserving access functionality.
2Object-affected harmful factors
If cache memory is reorganized frequently to protect data, then security is improved, but device complexity is worsened
Solution Approach 1:
The patent performs preliminary address transformation and obfuscation parameter generation before data is stored in the cache. By pre-computing the obfuscated addresses and setting up the transformation rules in advance, the system avoids complex runtime reorganization operations while maintaining strong security protection.
Solution Approach 2:
The patent uses parameter changes through obfuscation parameters that can be dynamically adjusted. Instead of reorganizing the entire cache structure, the system changes the addressing parameters used for mapping, which simplifies the implementation while maintaining security. The obfuscation parameters are updated without requiring physical cache reconfiguration.
3Object-affected harmful factors
If obfuscation parameters are used to transform addresses, then security is improved, but calculation time is worsened
Solution Approach 1:
The patent performs address obfuscation and transformation calculations in advance during the data loading phase, before the data is actually accessed. By pre-transforming addresses and pre-computing obfuscated mappings, the system eliminates time-consuming calculations during subsequent data access operations, maintaining fast read/write performance.
Solution Approach 2:
The patent creates a copy of the address transformation logic and pre-computed mappings that can be quickly applied during data access. Instead of performing complex obfuscation calculations in real-time, the system uses pre-generated transformation tables or simplified lookup mechanisms that provide security without the time cost of full obfuscation recomputation.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
The invention relates to a method (200) for protecting security-relevant data in a cache memory, wherein a copy of this security-relevant data from a general memory is stored in the cache memory, having the method steps of: stipulating (210) obfuscation parameters, determining (220) a first cache set address from a memory address of the general memory at which the security-relevant data are stored, generating (230) a first modified cache set address for a first cache set with a generation function using the obfuscation parameters and the first cache set address, and storing (240) the copy of the security-relevant data using the first modified cache set address in a first cache line (131) of the first cache set.