Cache Memory Management via Dynamic Permutation for Side-Channel Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cache memory management techniques are inadequate in preventing side-channel attacks that observe cache memory states, particularly through timing measurements, as they either lead to inefficient use of cache resources or fail to protect against all types of attacks.
Innovation Solution
A method and unit for managing cache memory that employs a permutation function to dynamically change the addressing of cache memory sets, ensuring that even if a malicious process observes cache access patterns, it cannot deduce information about the process under attack, by modifying the parameter q used in the permutation function regularly and storing lines in new locations, thereby increasing the difficulty of side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cache memory is partitioned into separate partitions for each process, then security against side-channel attacks is improved, but cache memory efficiency deteriorates
Solution Approach 1:
The patent applies dynamics by making the cache addressing scheme changeable over time through periodic modification of the permutation function. The cache memory transitions from a static partitioning scheme to a dynamic one where the mapping between process addresses and cache sets changes periodically, allowing the same physical cache resources to be securely shared among multiple processes while maintaining security against side-channel attacks.
Solution Approach 2:
The patent changes the parameter q of the permutation function periodically to modify the addressing scheme. By varying this parameter, the system transforms the cache addressing without requiring physical repartitioning, thus maintaining security while preserving cache memory efficiency and avoiding the waste associated with static partitioning.
2Reliability
If cache addressing is modified frequently to prevent attacks, then security is improved, but performance deteriorates due to increased cache misses
Solution Approach 1:
The patent applies preliminary action by pre-modifying the addressing scheme only when specific conditions are met (cache miss or eviction), rather than continuously. This allows the system to maintain security while minimizing the frequency of addressing changes, thereby preserving cache effectiveness and avoiding unnecessary performance degradation.
Solution Approach 2:
The patent implements periodic modification of the permutation function parameter q at predetermined intervals or upon specific events. This periodic action provides sufficient security against side-channel attacks while limiting the frequency of changes to maintain acceptable cache performance, resolving the contradiction between security and performance.
3Reliability
If lines are relocated to new cache sets, then security against observation attacks is improved, but system complexity increases
Solution Approach 1:
The patent applies universality by using a single permutation function with a modifiable parameter q to handle multiple cache management operations. This same function is used for both initial line placement and subsequent relocation, providing a unified mechanism that simplifies the overall system architecture while maintaining security against observation attacks.
Solution Approach 2:
The patent introduces the permutation function parameter q as an intermediary that mediates between the process address space and the physical cache sets. By modifying this intermediate parameter rather than directly managing complex relocation logic, the system achieves security improvements while keeping the management mechanism relatively simple and elegant.
Data Source
AI summary
Method for managing a cache memory comprising:the transformation of a received set address in order to find a word in the cache memory, into a transformed set address by means of a bijective transformation function,the selection of one or more line tags stored in the cache memory at the transformed set address.in which:the transformation function is parameterized by a parameter q such that the transformed set address obtained depends both on the received set address and on the value of this parameter q, and for all the non-zero values of the parameter q, the transformation function permutes at least 50% of the set addresses, andduring the same execution of the process, a new value of the parameter q is repeatedly generated for modifying the transformation function.