Side Cache Hardware Mitigation for Spectre and Meltdown Vulnerabilities
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current processor architectures are vulnerable to cache attacks from malicious applications due to cache miss events, which existing software solutions attempt to mitigate at the cost of processing performance.
Innovation Solution
A hardware solution involving a side cache coordinated with the main cache to move data from the side cache to the main cache when an instruction is retired, and discarding data when the instruction is determined to be abandoned, preventing speculative instructions from modifying the cache state and reducing cache miss vulnerabilities without impacting performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software cache randomization techniques are used to prevent cache attacks, then security against cache vulnerabilities is improved, but processor performance deteriorates due to encoding and decoding overhead
Solution Approach 1:
The patent replaces software-based cache randomization with a hardware-based side cache mechanism. The side cache is a physical hardware component that automatically stores speculative data accesses, eliminating the need for software encoding/decoding operations while providing the same security function of preventing cache state manipulation by malicious applications.
Solution Approach 2:
The side cache acts as an intermediary buffer between the main cache and speculative instruction execution. It intercepts speculative data accesses and stores them separately, preventing them from contaminating the main cache state while allowing legitimate accesses to proceed normally, thus maintaining both security and performance.
2Productivity
If speculative instruction execution is allowed to improve processing performance, then productivity is improved, but cache attack vulnerabilities increase due to cache miss events
Solution Approach 1:
The patent segments the cache system into two independent parts: the main cache for legitimate applications and the side cache for speculative executions. This segmentation allows speculative instructions to access memory without affecting the main cache state, enabling performance optimization while preventing security vulnerabilities.
Solution Approach 2:
The patent extracts speculative data accesses from the main cache system and isolates them in a separate side cache. By removing speculative accesses from the main cache pathway, the system eliminates the security vulnerability while preserving the performance benefits of speculative execution.
Data Source
AI summary
A device including a processor configured to access data to execute multiple instructions and a first cache coupled to the processor, are provided. The first cache is configured to hold a first data fetched from a memory by a first instruction that has been retired. The device also includes a side cache coupled to the first cache and to the processor, the side cache configured to hold a second data fetched from the memory by a second instruction, wherein the second instruction has not been retired from the processor. And the device includes a cache management unit configured to move the second data from the side cache to the first cache when the second instruction is retired, the cache management unit further configured to discard the second data when it is determined that the second instruction is abandoned.