Cache Partitioning for Software Side Channel Attack Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software side channel attacks exploit inter-process leakage through CPU memory cache, allowing unprivileged processes to deduce sensitive data despite partitioning methods, and existing prevention methods impact performance or require additional silicon area.
Innovation Solution
A cache management unit dynamically partitions the cache and overwrites cache sections with application data to prevent side channel attacks, using a context switch unit to identify context changes and an application analysis unit to determine protection needs, ensuring sensitive data access patterns are obscured.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a separate cache system is implemented for each logical processor, then software side channel attacks are prevented, but additional silicon area is required which increases cost
Solution Approach 1:
The shared cache is divided into multiple cache partitions, each associated with a specific process or logical processor. This segmentation allows different processes to access different cache partitions, preventing side channel attacks while sharing the same physical cache hardware, thus avoiding the need for separate cache systems for each processor.
2Reliability
If the cache is flushed after context switches, then software side channel attacks are prevented, but application performance is negatively impacted
Solution Approach 1:
Instead of flushing the cache after context switches (which causes performance degradation), the system performs preliminary actions by establishing cache partitions before context switches occur. The partition indicator is set in advance, and the cache management unit automatically directs cache accesses to the appropriate partition, eliminating the need for post-context-switch flushing while maintaining security.
3Reliability
If the cache is turned off, then software side channel attacks are prevented, but application performance is negatively impacted
Solution Approach 1:
The cache is segmented into multiple partitions that can be independently managed. Instead of turning off the entire cache, the system activates only the relevant cache partitions for each process, maintaining cache functionality and performance while preventing cross-process side channel attacks through partition isolation.
4Reliability
If cache partitions are used with partition indicators, then side channel attacks are prevented, but device complexity increases
Solution Approach 1:
The cache management unit automatically manages cache partitions based on partition indicators without requiring complex manual configuration. The system self-adjusts cache access directions based on the current process's partition indicator, reducing the operational complexity of implementing partitioned cache architecture.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for managing a cache is disclosed. A context switch is identified. It is determined whether an application running after the context switch requires protection. Upon determining that the application requires protection the cache is partitioned. According to an aspect of the present invention, a partitioned section of the cache is completely over written with data associated with the application. Other embodiments are described and claimed.