Secure Cache Indexing via Cryptographic Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cache indexing methods are vulnerable to reverse engineering and side-channel attacks, such as prime and probe cache side-channel attacks, due to their simplicity and susceptibility to pathological conflicts.
Innovation Solution
Implementing a strong hash function to generate a secure index for cache look-ups, which combines a cache block address with a key and uses dynamic re-keying with two hashes/keys in parallel, making it harder to find hash collisions and reduce the likelihood of pathological conflict cases, and adding entropy to the hash function to obscure timing side channels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cache indexing using direct address bits is used, then cache operations are simple and fast, but the cache is vulnerable to reverse engineering and side-channel attacks
Solution Approach 1:
The patent transforms the cache indexing mechanism by changing the parameter of the hash function from a simple identity function to a secure cryptographic hash function. This transformation maintains the indexing functionality while significantly improving security against reverse engineering and side-channel attacks, as the secure hash function obscures the relationship between physical addresses and cache indices.
Solution Approach 2:
The patent introduces a secure hash function as an intermediary between the physical address and the cache index. This intermediary component processes the address through a cryptographic transformation, preventing direct observation of the indexing pattern and blocking attackers from inferring cache geometry and contents through traditional timing analysis.
2Reliability
If a secure hash function with dynamic re-keying is implemented, then security against side-channel attacks is improved, but computational overhead and complexity increase
Solution Approach 1:
The patent implements dynamic re-keying where the secure hash function's key is periodically changed. This dynamic approach enhances security by preventing long-term correlation of timing patterns, while the key changes are managed efficiently through hardware support that minimizes the computational overhead of key rotation.
Solution Approach 2:
The patent performs preliminary computation of hash values and key management operations in advance of actual cache access patterns. By pre-computing secure indices and managing key transitions beforehand, the system reduces the real-time computational burden during critical cache operations, thereby lowering energy consumption during active processing.
3Difficulty of detecting and measuring
If strong hash functions are used to obscure cache indexing, then reverse engineering difficulty increases, but pathological conflicts in cache operations become more likely
Solution Approach 1:
The patent carefully selects and configures the secure hash function parameters (such as output bit length and internal structure) to achieve an optimal balance. The hash function is designed to provide sufficient diffusion and confusion properties to prevent reverse engineering, while its parameter configuration ensures uniform distribution of hash outputs that minimizes pathological conflicts and maintains cache operation reliability.
Data Source
AI summary
A system, apparatus and method for secure functions and manipulating cache line data. The method includes generating cache block addresses from a subset of bits, i.e. tag bits, of a cache address and hashing the cache block addresses with one or more secure functions that use keys to generate secure indexes.