Zombie Bit Cache Line Flush Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems are ineffective in mitigating Flush-based attacks on cache memory while retaining page sharing and avoiding application rewriting or reliance on profile information, as they rely on OS-based or software-based techniques that are not optimal for modern computing architectures.
Innovation Solution
The introduction of a zombie bit in cache lines to identify and mitigate Flush-based attacks by marking cache lines as invalid zombie lines upon flush-caused invalidation, using cache hits and misses to detect attacks, and employing hardware counters to track access patterns and notify the operating system of potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If OS-based page sharing is enabled to improve memory capacity and reduce redundant copies, then memory efficiency is improved, but cache side channels between applications are created enabling Flush-based attacks
Solution Approach 1:
The patent segments the cache line into multiple fields including a zombie bit field separate from the valid bit field. This segmentation allows independent tracking of attack states without affecting normal cache operation or page sharing functionality.
Solution Approach 2:
The zombie bit acts as an intermediary marker between the cache line and the attack detection mechanism. It mediates the interaction by providing a dedicated state indicator that triggers mitigation only when attack patterns are detected, without interfering with legitimate page sharing operations.
2Reliability
If Flush-based attack mitigation is implemented using prior software-based techniques, then attack protection is improved, but system performance is degraded due to overhead from application rewriting or profile reliance
Solution Approach 1:
The cache controller performs self-service by autonomously detecting attack patterns through the zombie bit and automatically executing mitigation actions without requiring application rewriting or external profile information. This eliminates the performance overhead associated with software-based mitigation approaches.
Solution Approach 2:
The zombie bit is set in advance during flush operations as a preliminary action. This pre-marking enables rapid attack detection and response without requiring complex real-time analysis or application-level interventions, thereby maintaining system performance.
3Reliability
If cache lines are invalidated upon flush-caused invalidation to prevent attack, then security is improved, but legitimate cache usage is disrupted affecting system performance
Solution Approach 1:
The patent applies local quality by setting the zombie bit only for specific cache lines that are targets of flush operations, rather than invalidating all cache lines. This localized approach maintains security for attacked lines while preserving normal cache functionality for non-attacked lines.
Solution Approach 2:
The cache line state is made dynamic through the zombie bit that can transition between invalid and attack-detected states. This dynamic state management allows the system to adaptively respond to attacks only when necessary, rather than maintaining a static invalidation state that would disrupt legitimate cache usage.
Data Source
AI summary
Disclosed herein are systems and methods for identifying and mitigating Flush-based cache attacks. The systems and methods can include adding a zombie bit to a cache line. The zombie bit can be used to track the status of cache hits and misses to the flushed line. A line that is invalidated due to a Flush-Caused Invalidation can be marked as a zombie line by marking the zombie bit as valid. If another hit, or access request, is made to the cache line, data retrieved from memory can be analyzed to determine if the hit is benign or is a potential attack. If the retrieved data is the same as the cache data, then the line can be marked as a valid zombie line. Any subsequent hit to the valid zombie line can be marked as a potential attack. Hardware- and software-based mitigation protocols are also described.