Hardware Cache Scrambling for VM Side-Channel Mitigation

The patent implements dynamic cache set mapping where the mapping between cache sets and physical address tags changes over time through epoch transitions. During each epoch, a specific scrambling key is used to dynamically remap cache sets, making the cache access pattern unpredictable to attackers while maintaining efficient cache operation. This dynamic remapping prevents side-channel attacks by ensuring that an attacker VM cannot reliably infer victim VM's cache access patterns across epoch boundaries.

The patent changes the mapping parameter (cache set to tag association) by applying scrambling keys that transform the relationship between cache sets and physical addresses. Each epoch uses a different scrambling key, effectively changing the parameter mapping to obscure the true access patterns. This parameter transformation allows the shared cache to maintain high utilization while preventing information leakage through altered address mapping relationships.

The patent performs preliminary cache flushing and remapping actions at epoch boundaries before new cache operations begin. By proactively invalidating cache sets during epoch transitions and establishing new scrambled mappings in advance, the system ensures security isolation is maintained without causing performance degradation during normal cache operations within each epoch. The preliminary action confines the overhead to transition periods rather than continuous operation.

The patent implements periodic epoch transitions that occur at predetermined intervals, during which cache scrambling keys are updated and cache sets are flushed. This periodic action creates a rhythm of security reinforcement that maintains isolation between VMs while allowing efficient cache operation during each epoch period. The periodic nature ensures that security measures are applied systematically without continuously disrupting cache performance.