Protected Cache Segmentation for Private Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Personal computer platforms are vulnerable to cache attacks that allow malicious applications to access private data, exploiting security holes and bypassing virtual address separation, necessitating enhanced protection mechanisms.
Innovation Solution
The implementation of a Protected Cache and Speculative Versioning Cache, which provide private and non-coherent storage for sensitive data, preventing unauthorized access and eviction, through mechanisms like least recently used (LRU) favoring and flushing, ensuring data privacy and security during cryptographic operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If standard cache is used for storing data, then access speed is improved, but security against cache attacks deteriorates
Solution Approach 1:
The cache is segmented into private cache regions allocated to individual applications and shared cache regions. Each application's private cache is isolated from others, preventing cache attacks while maintaining fast access speeds within the private region. The segmentation is enforced through hardware mechanisms that track cache line ownership and prevent unauthorized access.
Solution Approach 2:
Different security properties are applied to different parts of the cache system. Private cache lines have strict access controls and coherence validation, while shared cache lines use standard protocols. This local differentiation allows secure handling of sensitive data in private regions while maintaining overall system performance.
2Object-affected harmful factors
If virtual address separation is used to protect private data, then security is improved, but malicious applications can still bypass it through security holes
Solution Approach 1:
The system performs preliminary validation of cache access requests by checking coherence and ownership attributes before allowing access. This preliminary anti-action prevents malicious applications from exploiting security holes to access private data, as the hardware enforces access rules at the cache level rather than relying solely on software-based virtual address separation.
Solution Approach 2:
A hardware-mediated cache coherence and access control mechanism acts as an intermediary between applications and the cache memory. This intermediary enforces security policies by validating access requests, tracking cache line ownership, and preventing unauthorized access to private data, thereby reinforcing virtual address separation with hardware-level protection.
3Object-affected harmful factors
If private non-coherent cache storage is implemented, then security against cache attacks is improved, but cache management complexity increases
Solution Approach 1:
The private cache implementation uses self-service mechanisms where each application's cache lines are automatically tagged with private attributes and coherence information. The cache management hardware automatically handles access validation and coherence enforcement without requiring complex external control logic, thereby reducing overall system complexity while maintaining security.
4Object-affected harmful factors
If LRU favoring mechanism is used to prevent eviction, then data privacy is improved, but cache eviction policy complexity increases
Solution Approach 1:
The LRU favoring mechanism applies different eviction policies to different parts of the cache. Private cache lines are favored and protected from eviction to maintain data privacy, while shared cache lines use standard LRU replacement. This localized application of eviction policies protects private data without requiring complete redesign of the cache management system.
Data Source
AI summary
A method and apparatus for protecting private data from cache attacks. One embodiment includes storing private data in a protected cache line to protect it from cache attacks. A snoop request may be received to the protected cache line. In response to the snoop request, a miss may be transmitted. Other embodiments are also disclosed and claimed.