Oblivious Data Structure Engine for Cache Attack Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security solutions fail to effectively protect against cache attacks and side-channel attacks, which exploit memory access patterns and metadata, even when using protection techniques like partitioning and randomization, as these methods require significant processing overhead or hardware support and can compromise locality of reference.
Innovation Solution
Implementing an oblivious data structure engine that uses tree-like data structures, such as splay trees, to encrypt and rearrange data blocks in memory, obscuring memory access patterns by constantly changing the physical location of data, making it unintelligible to adversaries, while maintaining efficiency and locality of reference.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security solutions (flood decoy accesses, shuffle memory contents) are used to protect against cache attacks, then security against side-channel attacks is improved, but processing time and overhead increase significantly
Solution Approach 1:
The patent applies dynamics by making the data structure itself dynamic and self-rearranging. Instead of using static protection mechanisms that require external intervention (flood decoys, shuffling), the oblivious data structure automatically reorganizes its nodes based on access patterns, providing continuous protection without external processing overhead. The structure adapts its configuration dynamically in response to access requests, obscuring memory access patterns inherently.
Solution Approach 2:
The oblivious data structure provides self-service protection by autonomously obscuring its own memory access patterns. The structure rearranges its nodes based on access frequency and patterns without requiring external security mechanisms. This self-organizing behavior provides security protection inherently, eliminating the need for separate security processing layers that would increase overhead.
2Reliability
If randomization techniques are used to protect cryptographic primitives, then security is improved, but the same cryptographic primitives that need protection are compromised
Solution Approach 1:
The patent applies segmentation by separating the cryptographic primitive logic from its data storage and access patterns. The oblivious data structure segments the protection mechanism into structural organization (tree nodes, pointers, levels) rather than relying on cryptographic randomization. This segmentation allows the cryptographic primitives to operate on their data while the data structure's physical layout provides the obscuration, avoiding compromise of the primitives themselves.
3Reliability
If significant hardware support is added to the processor or memory for security protections, then security against cache attacks is improved, but device complexity increases
Solution Approach 1:
The patent applies mechanics substitution by replacing hardware-based security mechanisms with a software/data structure-based approach. Instead of modifying processors or memory hardware to provide security protections, the solution uses an oblivious data structure implemented in software that provides equivalent protection through its self-organizing properties. This substitution eliminates the need for complex hardware modifications while maintaining security effectiveness.
4Reliability
If conventional protection methods are used to obscure memory access patterns, then security is improved, but locality of reference is compromised
Solution Approach 1:
The patent applies dimensionality change by organizing data in a multi-level tree structure rather than linear memory sequences. The oblivious data structure uses hierarchical levels and pointer-based navigation to access data, transforming the one-dimensional memory access pattern into a multi-dimensional traversal pattern. This dimensional transformation allows the structure to obscure access patterns while maintaining logical data relationships and improving locality through spatial organization in the tree hierarchy.
Data Source
AI summary
Software protection using data structures is described. In one implementation, an engine between the processor and the memory of a computing device encrypts and stores data and program variables in blocks of memory that correspond to nodes of a tree-like data structure. When accessed, the nodes of this search tree are rearranged according to various schemata to obscure memory access patterns from being detected by cache attacks or side-channel attacks. In one implementation, the data structure is a splay tree that self-rearranges upon access and increases efficiency while providing security.