Cache Priority Management for Prime and Probe Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Prime and probe side-channel attacks on Simultaneous Multithreading processors are challenging to mitigate, as existing methods like hard partitioning of the cache increase conflict misses and underutilization, making it difficult to determine optimal way allocation for processes.
Innovation Solution
Implementing a shared cache with right-to-replace and right-to-be-replaced priority levels, where cache blocks are assigned priority levels, preventing lower priority processes from displacing higher priority ones, thereby preventing prime and probe attacks by allowing an operating system or hypervisor to manage cache access policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hard partitioning of the cache is used to prevent prime and probe attacks, then security against side-channel attacks is improved, but conflict misses increase and cache utilization deteriorates
Solution Approach 1:
The patent implements dynamic cache way allocation where the partitioning of cache ways between victim and spy processes is not fixed but can change based on current execution state. The system uses a dynamic partitioning mechanism that adjusts which cache ways are allocated to which process, allowing the cache to adapt to different workloads and prevent both prime-and-probe attacks and performance degradation from static partitioning.
Solution Approach 2:
The system changes the parameter of cache way allocation from a static hard partitioning scheme to a dynamic scheme controlled by priority levels and execution state. The patent introduces priority level parameters that determine cache access rights, allowing the system to adjust cache allocation based on process priority and execution context rather than using fixed partitioning.
2Reliability
If cache ways are allocated to prevent attacks, then security is improved, but determining optimal way allocation becomes more complex
Solution Approach 1:
The patent implements a self-service mechanism where the cache system automatically manages way allocation based on process priority levels without requiring complex external control. The priority level information stored in the system enables automatic determination of which process gets access to which cache ways, reducing the complexity of cache management while maintaining security.
Solution Approach 2:
The system uses feedback from process priority levels to automatically adjust cache way allocation. The priority level information provides feedback that the cache management mechanism uses to dynamically determine access rights, creating a closed-loop system that adapts to different execution scenarios without complex external intervention.
3Speed
If lower priority processes are prevented from displacing higher priority cache blocks, then higher priority process performance is maintained, but cache access flexibility is reduced
Solution Approach 1:
The patent implements dynamic control of cache access rights based on process priority levels. The system can dynamically adjust which processes have the right to replace cache blocks, allowing higher priority processes to maintain cache blocks while enabling flexibility for lower priority processes under certain conditions. This dynamic approach balances performance requirements with access flexibility.
Data Source
AI summary
Described herein are systems and methods for prime and probe attack mitigation. For example, some methods include, responsive to a cache miss caused by a process, checking whether a priority level of the process satisfies a first priority requirement of a first cache block of a cache with multiple ways including cache blocks associated with respective priority requirements; responsive to the priority level satisfying the first priority requirement, loading the first cache block; and, responsive to the priority level satisfying the first priority requirement, updating the first priority requirement to be equal to the priority level of the process.