Secure Cache Indexing via Cryptographic Hash Functions

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing cache indexing methods are vulnerable to reverse engineering and side-channel attacks, such as prime and probe cache side-channel attacks, due to their simplicity and susceptibility to pathological conflicts.

Innovation Solution

Implementing a strong hash function that combines a cache block address with a key to generate a unique secure function, using dynamic re-keying with two hashes/keys in parallel, and assigning a random index to each cache address at boot time to make reverse engineering harder and reduce timing side channels.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If traditional cache indexing using direct address bits is used, then cache operation simplicity is improved, but security against side-channel attacks deteriorates

Engineering Contradiction:
Improvecache operation simplicityVSAvoidside-channel attack vulnerability
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a secure hash function as an intermediary between the cache address and the cache index. Instead of directly using address bits for indexing, the address is first processed through a cryptographic hash function (e.g., SHA-256) to generate a hash value, which then serves as the cache index. This intermediary transformation obscures the relationship between addresses and cache locations, preventing attackers from inferring address information through cache timing analysis while maintaining efficient cache operations.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Ease of manufacture

If simple address-based cache indexing is used, then hardware implementation ease is improved, but resistance to reverse engineering deteriorates

Engineering Contradiction:
Improvehardware implementation easeVSAvoidreverse engineering resistance
Core Design Contradiction:
Ease of manufactureVSDifficulty of detecting and measuring

Solution Approach 1:

The patent replaces the traditional mechanical/address-based indexing system with a cryptographic hash-based indexing system. Instead of directly mapping address bits to cache indices through simple bitwise operations, the system uses cryptographic hash functions to transform addresses into indices. This substitution makes the cache geometry invisible to reverse engineering attempts, as the hash function output appears random and provides no information about the underlying cache structure or address mappings.

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

3Device complexity

If traditional cache indexing is used, then indexing simplicity is improved, but occurrence of pathological conflicts worsens

Engineering Contradiction:
Improveindexing complexityVSAvoidcache operation reliability
Core Design Contradiction:
Device complexityVSReliability

Solution Approach 1:

The patent fundamentally changes the indexing parameter from direct address bits to cryptographic hash values. By transforming the index generation process from a linear bitwise operation to a non-linear cryptographic hash function, the patent distributes cache accesses more uniformly across the cache space. This parameter change eliminates pathological conflicts that occur in traditional indexing where specific address patterns systematically collide into the same cache indices, thereby improving cache operation reliability and performance consistency.

Inventive Principle:
Principle #35Parameter changes

Data Source

PatentUS10942856B2System, method and apparatus for secure functions and cache line data
Publication Date: 2021.03.09 ARM LTD
  • US10942856B2 patent drawing
  • US10942856B2 patent drawing
  • US10942856B2 patent drawing

AI summary

A system, apparatus and method for secure functions and manipulating cache line data. The method includes generating cache block addresses from a subset of bits, i.e. tag bits, of a cache address and hashing the cache block addresses with one or more secure functions that use keys to generate secure indexes.