Randomized Cache Partitioning for Low-Overhead Gradual Re-Keying
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cache designs are susceptible to side-channel attacks, leading to information leakage and security vulnerabilities, with current solutions either compromising performance or scalability, or requiring complex software changes.
Innovation Solution
Implement a gradual re-keying scheme for cache-set randomization, combining cache partitioning and skewing to provide different security-performance trade-offs, allowing selective protection levels per partition, and using biased replacement policies to minimize performance impact.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If cache-set randomization is implemented to protect against side-channel attacks, then security is improved, but performance deteriorates due to cache flushing and re-keying overhead
Solution Approach 1:
The cache is divided into multiple segments, each with its own independent randomization key. This allows selective re-keying of only certain cache segments rather than flushing the entire cache, thereby maintaining security while reducing performance overhead. The segmentation enables granular control over which cache portions require re-randomization based on security requirements.
Solution Approach 2:
The cache randomization system implements dynamic re-keying where the randomization key is changed periodically or based on security events. This dynamic approach allows the system to adapt security levels as needed while managing performance impact through controlled re-keying intervals and conditional cache flushing based on security threats.
2Reliability
If frequent re-keying is performed to enhance security, then security is improved, but performance deteriorates due to increased cache flushing operations
Solution Approach 1:
By segmenting the cache into multiple independently re-keyable portions, the system can perform re-keying operations on smaller cache segments rather than the entire cache. This reduces the time and overhead associated with each re-keying operation while maintaining security through cumulative coverage of all segments over time.
Solution Approach 2:
The system implements periodic re-keying where cache segments are re-randomized at scheduled intervals rather than continuously. This periodic approach balances security requirements with performance considerations by limiting re-keying frequency to necessary intervals while still providing security protection.
3Reliability
If uniform high-security protection is applied to the entire cache, then security is improved, but adaptability deteriorates as different workloads require different protection levels
Solution Approach 1:
Different cache segments can be assigned different security levels and re-keying frequencies based on the sensitivity of the data they store. This local quality approach allows the system to apply high-security measures to critical cache segments while using lighter protection on less sensitive segments, providing adaptability to different workload requirements and optimizing the security-performance trade-off.
Data Source
AI summary
Techniques for partitioning and/or gradual re-keying of randomized caches are described. In certain examples, an apparatus includes an execution circuit to cause a memory access request; a cache to store a plurality of sets, each of the sets to include a plurality of cache lines; and a cache randomizer circuit to generate a randomized index into the plurality of sets of the cache based on an address of the memory access request by encrypting a first subset of bits of the address of the memory access request to generate an encrypted value, and generating the randomized index based on a first subset of bits of the encrypted value. The encrypting is to be based on a first key for a first segment of the cache and a second segment of the cache during a first period, on a second key for the first segment of the cache and the first key for the second segment of the cache during a second period, and on the second key for the first segment of the cache and the second segment of the cache during a third period.