Cloud Cache Mapping to Obscure VM Side-Channel Leakage

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Side-channel attacks exploit side-channel information leaks in cloud systems, posing a significant security threat by allowing attackers to infer protected information from non-functional system parameters, and existing mitigation methods are resource-intensive or costly.

Innovation Solution

A method for data storage in cloud systems that maps protected information of multiple virtual machines (VMs) to the same cache area, using existing threads to create interference and noise, making it difficult for attackers to discern and steal sensitive information.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If protected information of multiple VMs is stored in separate cache areas, then information isolation is maintained, but side-channel attacks can exploit cache access patterns to infer sensitive data

Engineering Contradiction:

Improveinformation securityVSAvoidside-channel attack vulnerability

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent merges protected information from multiple VMs into the same cache area, specifically mapping encrypted data and encryption keys to overlapping cache lines. This combination creates interference patterns that prevent attackers from distinguishing individual VM access patterns, thereby mitigating side-channel attacks while maintaining information security

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The patent converts the potential harm of cache sharing (which enables side-channel attacks) into a beneficial security feature. By intentionally causing protected information from different VMs to overlap in cache, the system creates noise that protects individual VMs from attacks, turning the vulnerability into a defense mechanism

Inventive Principle:

Principle #22Blessing in disguise (Convert harm into benefit)

2Reliability

If cache access patterns are made uniform across VMs, then side-channel attack resistance increases, but cache performance optimization is reduced

Engineering Contradiction:

Improveattack resistanceVSAvoidcache access efficiency

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent applies local quality by selectively mapping only protected information (encrypted data and encryption keys) to overlapping cache areas, while allowing non-protected data to use traditional cache allocation methods. This targeted approach provides security benefits for sensitive data without unnecessarily impacting overall cache performance

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS20250355691A1Method for data storage and computing device

Publication Date: 2025.11.20 HUAWEI TECH CANADA CO LTD

AI summary

A method for data storage is applied to a cloud system that includes a plurality of virtual machines (VMs) and a control device. The method is performed by the control device. The method includes: receiving at least two requests from at least two VMs among the plurality of VMs, a request from each VM of the at least two VMs being used to indicate protected information of the VM; and mapping protected information of the at least two VMs to a first area of a cache. This can increase the difficulty for an attacker to carry out a side-channel attack, enhance the protection of information of each VM, and in turn avoid side-channel attacks.