Processor L1 Cache Segmentation for Multithreading Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Processors supporting simultaneous multithreading are vulnerable to security breaches due to resource sharing among logical processing units, which can lead to unauthorized access to data, and disabling this feature reduces multithreading capabilities.
Innovation Solution
Implementing a method that allows processors to control the execution of applications within protected environments, referred to as enclaves, using built-in instruction code to enforce trust declarations and ensure only trusted applications execute on the same physical processing unit, thereby preventing unauthorized access without disabling multithreading.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If simultaneous multithreading is enabled to improve processor productivity, then multithreading capabilities are enhanced, but security vulnerabilities arise due to resource sharing among logical processing units
Solution Approach 1:
The patent divides the shared L1 cache into separate cache partitions, each dedicated to a specific logical processing unit. This segmentation prevents applications running on different logical processing units from accessing each other's cache data, eliminating security vulnerabilities while preserving simultaneous multithreading capabilities. The cache is partitioned such that each partition is exclusively accessible by its associated logical processing unit, thereby maintaining both productivity and security.
2Productivity
If resource sharing among logical processing units is implemented to improve processor efficiency, then multithreading performance is enhanced, but unauthorized access to data becomes possible
Solution Approach 1:
The L1 cache is segmented into multiple partitions, with each partition exclusively assigned to a specific logical processing unit. This segmentation eliminates unauthorized data access between logical processing units while preserving the efficiency benefits of multithreading. Each logical processing unit can fully utilize its dedicated cache partition without interference from other units.
Solution Approach 2:
The patent applies local quality by providing each logical processing unit with its own dedicated cache partition, giving each unit exclusive access to its local cache resources. This local quality ensures that data stored in one logical processing unit's cache cannot be accessed by other logical processing units, preventing unauthorized access while maintaining overall processor efficiency.
3Device complexity
If logical processing units share cache resources to reduce device complexity, then the number of cache components is reduced, but security protections are compromised
Solution Approach 1:
Rather than implementing separate physical caches for each logical processing unit (which would increase complexity), the patent segments the existing L1 cache into multiple partitions. This approach maintains relatively simple device architecture while providing the security benefits of isolated cache access. The segmentation is achieved through cache control logic that directs accesses to appropriate partitions based on the logical processing unit.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are methods, devices, and apparatuses, including computer programs stored on computer-readable media, for executing applications. One of the methods includes: establishing an enclave in a first physical processing unit of a processor; recording a first trust declaration declared by a first application, the first trust declaration declaring whether the first application trusts any application to execute with the first application on the first physical processing unit; assigning the first application to a first logical processing unit hosted on the first physical processing unit; providing a set of enclave entry instructions for the first logical processing unit to execute, to cause the first logical processing unit to enter the enclave when a predefined entering condition is satisfied; and providing a set of enclave exit instructions for the first logical processing unit to execute, to cause the first logical processing unit to exit the enclave when a predefined exiting condition is satisfied.