KR20210096500A - Method and Apparatus for protecting caches from side-channel attacks - Google Patents

Abstract

As a preferred embodiment of the present invention, provided is a device for protecting against a cache-based side-channel attack, which adds a shared DRAM L4 cache, adds a bypass bit to L1, L2, and L4 caches, applies an LLC bypass policy to a cache block which is a target of a flush reload attack, and neutralizes the attack on the shared cache.

Description

{Method and Apparatus for protecting caches from side-channel attacks}

The present invention relates to cache-based side-channel attack defense.

Today's processors often have caches that can store copies of data and instructions stored in large amounts of memory. A popular example of such a large capacity memory is dynamic random access memory (DRAM). Herein, the term “memory” is used to collectively refer to all existing and future memory implementations. Cache memory ("cache" for short) is made with much smaller and much faster memory than other memory implementations, and can then store only a portion of the data stored in main memory or secondary storage at a particular point in time. Today caches are often implemented using SRAM, and large caches can be implemented using DRAM. The cache described herein may be implemented using any existing and future memory technology. The architectural definition of a processor may include providing enhanced reporting capabilities to be safe from security attacks, but many dependent functions such as cache implementations (e.g., micro-architecture) do not include protection, making them vulnerable to attacks. can

[1] Liu, Fangfei, et al. "Catalyst: Defeating last-level cache side channel attacks in cloud computing." 2016 IEEE international symposium on high performance computer architecture (HPCA). IEEE, 2016. [2] Kayaalp, Mehmet, et al. "RIC: relaxed inclusion caches for mitigating LLC side-channel attacks." 2017 54th ACM/EDAC/IEEE Design Automation Conference (DAC). IEEE, 2017. [3] Liu, Fangfei, and Ruby B. Lee. "Random fill cache architecture." Proceedings of the 47th Annual IEEE/ACM International Symposium on Microarchitecture. IEEE Computer Society, 2014.

In a preferred embodiment of the present invention, it is intended to propose a method for defending against all attacked applications that can be the target of a cache-based side-channel attack.

In a preferred embodiment of the present invention, it is intended to propose a method for preventing a cache-based side-channel attack by modifying a cache block that can be a target of a cache-based side-channel attack from entering the final level cache (LLC).

In a preferred embodiment of the present invention, the cache-based side-channel attack is prevented by limiting the cache block in the DRAM cache from being evicted with the clflush command, so that all processes experience the time to access the DRAM cache when accessing the corresponding cache block. We would like to suggest a way to defend it.

In a preferred embodiment of the present invention, it is intended to propose a method capable of defending against a cache-based side-channel attack regardless of whether data is writable or shared.

As a preferred embodiment of the present invention, the device for defending against a cache-based side-channel attack also implements a memory hierarchy to further include a shared DRAM cache, and in this case, each cache block of the shared DRAM cache includes a bypass bit. Including, indicating whether the attacker application is a side channel attack on the attacked application, and when the attacked application loads at least one cache block from the shared DRAM cache, the bypass bit in the at least one cache block Checking each, when the attacker application performs a flush-reload attack and then performs a reload, at least one cache block that performed the flush-reload attack is all loaded in the shared DRAM cache, so the attacker It is characterized in that the access time for at least one cache block for which the flush-reload attack is performed by the application is the same regardless of whether the attacked application accesses it.

As a preferred embodiment of the present invention, the device for defending against a cache-based side-channel attack has a value of the bypass bit checked when loading at least one cache block from the shared DRAM cache is 1, and the cache block for which the side-channel attack is confirmed. In this case, it bypasses the shared final level cache and loads it into the private cache, and in the case of a cache block in which a side channel attack is not confirmed as a bypass bit value of 0, it is characterized in that it is loaded into the shared final level cache. In this case, the private cache is an L1 cache or an L2 cache, and it is characterized in that the bypass bit value is changed from 0 to 1 when the cache block in which the side-channel attack is confirmed is loaded.

As a preferred embodiment of the present invention, the device for protecting against a cache-based side-channel attack includes a private cache; and a SRAM-based shared Last-Level Cache (LLC), and also a shared DRAM cache; implement a memory hierarchy to include, wherein the private cache and the shared DRAM cache include a bypass bit, and the attacker application determines whether a side-channel attack on the attacker application is performed using the bypass bit value, and the attacker When the application performs the flush-reload attack and then performs the reload, at least one cache block that performed the flush-reload attack is all loaded in the shared DRAM cache, so that the flush-reload attack in the attacker application It is characterized in that it is impossible to determine the access pattern and execution pattern of the attacked application because the access time for the at least one cache block that has been performed is the same irrespective of whether the attacked application accesses or not. In this case, the attacker application performs the flush-reload attack using the clflush command, and when the clflush command is executed, the cache blocks in the private cache and the shared last-level cache may be evicted, but in the shared DRAM cache It is characterized in that the cache block in existence is not evicted, and information is displayed using the bypass bit only whether clflush has been performed.

As another preferred embodiment of the present invention, a method for protecting against a cache-based side-channel attack includes using a memory hierarchy including a private cache, an SRAM-based shared last-level cache and a shared DRAM cache; using a bypass bit included in the cache block of the shared DRAM cache to display whether an attacker application has performed a flush-reload attack on the attacker application; when the attacked application loads at least one cache block from the shared DRAM cache, checking each of the bypass bits in the at least one cache block; and as a result of checking the bypass bit, the cache block on which the flush-reload attack has been performed bypasses the SRAM-based shared last-level cache* and is loaded into the private cache of the attacked application core, and the flush-reload attack is detected. It characterized in that it comprises; loading the cache block that is not done into the SRAM-based shared last-level cache.

As a preferred embodiment of the present invention, the attacker application can execute the flush attack by using the clflush command. In this case, the blocks in the private cache and the SRAM-based shared last-level cache of the attacker application are evicted. However, the block in the shared DRAM cache is not evicted, and information on whether the flush-reload attack is executed using a bypass bit in the cache block in the shared DRAM cache is provided.

As a preferred embodiment of the present invention, when the value of the bypass bit in the cache block in the shared DRAM cache is "1", it indicates that a flush-reload attack has been performed, and in this case, the private cache determines the value of the bypass bit. It is characterized in that the bypass bit value in the private cache is also displayed as "1" while loading the cache block in the shared DRAM cache, which is "1".

As a preferred embodiment of the present invention, when the attacker application performs a flush-reload attack and then performs a reload, at least one cache block that has performed the flush-reload attack is all loaded into the shared DRAM cache. In this case, since the access time to at least one cache block for which the flush-reload attack is performed in the attacker application is the same regardless of whether the attacked application is accessed, the access pattern and execution pattern of the attacked application cannot be determined. characterized in that

In a preferred embodiment of the present invention, there is an effect of defending against all attacker applications that can be the target of a cache-based side-channel attack through only hardware modification without modification of separate software.

In a preferred embodiment of the present invention, there is an effect of preventing a cache-based side-channel attack by transforming a cache block that can be a target of a cache-based side-channel attack from entering the final level cache (LLC).

In a preferred embodiment of the present invention, the cache-based side-channel attack is prevented by limiting the cache block in the DRAM cache from being evicted with the clflush command, so that all processes experience the time to access the DRAM cache when accessing the corresponding cache block. It has a protective effect.

In a preferred embodiment of the present invention, there is an effect that can prevent a cache-based side-channel attack regardless of whether data is writable or shared.

1 to 3 show a method of neutralizing a flow reload attack in a device for defending against a cache-based side-channel attack as a preferred embodiment of the present invention.
4 is a flowchart of a method for defending against a cache-based side-channel attack as a preferred embodiment of the present invention.

Since the present invention can have various changes and can have various embodiments, specific embodiments are illustrated in the drawings and will be described in detail through the detailed description. However, this is not intended to limit the present invention to specific embodiments, and it should be understood that the present invention includes all modifications, equivalents and substitutes included in the spirit and scope of the present invention.

The memory system of a computer system is close to main memory, and may include large, slow caches and processor-like, small and fast caches. The configuration of such a cache may be generally referred to as a cache layer, a memory layer, or a memory system. Each level of the cache hierarchy may be referred to as a cache level.

When designing a cache system, it can be important to avoid vulnerabilities to security attacks such as side-channel attacks. A flush+reload attack, which is a form of side-channel attack, is an attack in which an attacker finds out the attacker's command execution pattern and obtains the attacker's secret encryption key without permission.

As an example of a technique for defending against such a flushload attack, Liu, Fangfei, et al. "Catalyst: Defeating last-level cache side channel attacks in cloud computing." 2016 IEEE international symposium on high performance computer architecture (HPCA). IEEE, 2016. This method uses CAT, one of the functions of Intel CPU, to physically isolate data that needs to be protected through cache partitioning to neutralize the flush reload attack. However, in the case of this method, there is a disadvantage that is supported only by some processors supporting CAT.

Another technique is Kayaalp, Mehmet, et al. "RIC: relaxed inclusion caches for mitigating LLC side-channel attacks." 2017 54th ACM/EDAC/IEEE Design Automation Conference (DAC). In IEEE, 2017, by changing the cache policy so that read-only data is not stored in LLC, when an attacker application accesses cache blocks, which are the main attack targets for flush reloading, the long memory is always long regardless of whether the attacker application accesses it. We are using a method that allows access time to suffer. This method has a disadvantage in that data is limited to read-only data.

In one embodiment of the present invention, without modification of separate software, without the need to designate a virtual machine or process through only hardware modification, it is intended to defend against all attacker applications that can be the target of a cache-based side-channel attack. do. Also, we would like to propose a method to prevent cache-based side-channel attacks by modifying the cache blocks that can be the target of cache-based side-channel attacks from entering the final level cache (LLC).

1 to 3 show a method of neutralizing a flow reload attack in an apparatus for defending a cache-based side-channel attack as a preferred embodiment of the present invention.

The clflush instruction used in the preferred embodiment of the present invention evicts blocks in the L1 to L3 caches, but does not evict blocks in the shared L4 cache. Indicates the command to leave. When the bypass bit is "1", it indicates that clflush has been performed, and when the bypass bit is "0", it indicates that clflush is not performed.

As a preferred embodiment of the present invention, the device for protecting against a cache-based side-channel attack includes at least one private cache 130 , an SRAM-based shared cache 140 , and further includes a shared DRAM cache 150 . A memory hierarchy is implemented to In addition, each cache block of the shared DRAM cache 150 includes a bypass bit 151a to indicate whether the attacker application has a side channel attack on the attacker application. When the bypass bit is "1", it indicates that there was a side channel attack, and when the bypass bit is "0", it indicates that there is no side channel attack.

As a preferred embodiment of the present invention, the private cache 130 may be implemented as an L1 cache or an L2 cache, the SRAM-based shared cache 140 may be implemented as an L3 cache, and the shared DRAM cache 150 may be implemented as an L4 cache.

As a preferred embodiment of the present invention, the attacked application checks each of the bypass bits in at least one cache block when loading at least one cache block from the shared DRAM cache. And, when the bypass bit is "1", the corresponding cache block is loaded into the private cache 130 by bypassing the final level cache 140, and the bypass bits 131b and 131c of the private cache are changed from "0" to Change it to "1". The attacker application may be implemented to load the corresponding cache block into the final level cache 140 when the bypass bit is "0".

1 to 3, as a preferred embodiment of the present invention, a method for the apparatus 100 for defending against a cache-based side-channel attack to defend against a flush reload attack will be described. As a preferred embodiment of the present invention, FIG. 1 shows the process of performing an eviction through the "clush" command in the attacker application, FIG. 2 shows the waiting process after the "clflush" command, and FIG. 3 is the reloading process in the attacker application represents the process of performing

Referring to FIG. 1 , the attacker application 110 is in “Core 0” 111 and the attacker application 120 is in “Core 1” 121 , and the attacker application 110 is a cache block A and B. Assume that a flush reload attack is performed.

The attacker application 110 attempts to evict cache blocks A and B using the "clflush" command (S110). In this case, in the shared DRAM cache 150 in which the cache blocks A and B are written, the bypass bits in the cache blocks A and B 151a are set from "0" to "1".

Referring to FIG. 2 , the attacker application 120 checks each of the bypass bits 151b in the corresponding cache block when loading the cache block in the shared DRAM cache 150 (S130). As a result of checking, if the bypass bit 151b is "1", the final level cache bypass policy is applied to the cache block A that is the target of clflush (S140) to neutralize the flush reload attack. Then, the cache block A is loaded into the private cache of the attacker core 121, and the bypass bit included in the cache block A of the private cache is set to “1” (S131c). If the bypass bit of the cache block A in the shared DRAM cache 150 is "0", the cache block A is loaded into the last level cache.

3 shows a process of re-accessing cache blocks A and B in the shared DRAM cache 150 for reloading after waiting for a predetermined time after the "clflush" command in the attacker application. Since the attacker application 110 does not have both cache blocks A and B in the final level cache 140 , it must access the shared DRAM cache 150 . When the final level cache 140 is implemented as an L3 cache, and the shared DRAM cache 150 is implemented as an L4 cache, the attacker application 110 requires additional access time.

In addition, when the attacker application 110 performs a flush attack and then performs reloading, since both cache blocks A and B that have performed the flush attack are loaded in the shared DRAM cache 150, the attacker application 110 performs a flush attack. The access times for the cache blocks A and B that have performed are the same regardless of whether the attacker application 120 accesses or not. Therefore, the attacker application 110 cannot determine the access pattern and execution pattern of the attacked application 120, and the flush reload attack fails.

4 is a flowchart of a method for defending against a cache-based side-channel attack as a preferred embodiment of the present invention.

As a preferred embodiment of the present invention, the method for defending against a cache-based side-channel attack uses a hardware device using a memory hierarchy including a private cache, an SRAM-based shared cache, and a shared DRAM cache (S410).

When an attacker application attempts to evict at least one cache block in the shared DRAM cache, the shared DRAM cache sets the internal bypass bit value of each clflushed at least one cache block to “1” without evicting the cache block. do (S420). After that, while the attacker application is resting, when the attacker application loads at least one cache block from the shared DRAM cache, each of the bypass bits in the cache block is checked ( S430 ). When the bypass bit value is "1", the attacked application determines that the cache block is clflushed, and loads the corresponding cache block into the private cache of the attacked application core, bypassing the final level cache. Cache blocks in which other flush attacks are not detected are loaded into the final level cache (S440).

The key features of the present disclosure, including the exemplary embodiments discussed and presented in the drawings, may be implemented in a variety of architectures. In one embodiment, the cache may be controlled, accessed, or stored by one or more software components, such as threads or processes running on one or more processors. In one embodiment, a software library, such as a set of instructions stored in memory, is stored in the memory and may be accessed by processes and/or threads and/or applications of the operating system. In one embodiment, a set of instructions stored in a non-transitory computer-readable medium may be executed by a processor. In one embodiment, the cache may be controlled, accessed, or stored by one or more hardware devices. In one embodiment, such hardware devices may include processing circuitry, such as, but not limited to, one or more processors each having one or more processor cores. Such a processor may include a central processing unit (CPU), a graphics processing unit (GPU), a multi-core CPU or a core of a multi-core GPU, an arithmetic logic unit (ALU), a digital signal processor, Microcontroller, System-on-Chip (SoC), field programmable gate array (FPGA), programmable logic array (PLA), application specific integrated circuit , ASIC), a modular logic device, a packaged logic chip, and/or any other device capable of responding to and executing commands in a defined manner. In one embodiment, the cache may be stored, accessed, or stored by a combination of the same type or different types of configuration. For example, the configuration may include a plurality of processors, processing cores of a single processor, processing cores of a multiprocessor computer, two or more processors operating in series (eg, CPU and GPU, CPU using ASIC) , and/or software executed by a processor. Example embodiments may include the configuration of a single device, such as a computer, that includes one or more CPUs to store, access, and manage a cache. One embodiment may include components of multiple devices, such as two or more devices including CPUs in communication to access and/or manage caches. An embodiment may include a server computing device, a server computer, a server computer connection, a server farm, a cloud computer, a content platform, a mobile computing device, a smart phone, a tablet, or a set-top box. One embodiment is a component that communicates directly (eg, two or more cores of a multi-core processor) and/or a component that communicates indirectly (eg, via a bus, via a wired or wireless channel or network). , via an intermediate configuration such as a microcontroller or arbiter). An embodiment may feature multiple instances of the cache manager, each being performed by a device or configuration, and such instances may be executed concurrently, sequentially, and/or in an interleaved manner. An embodiment may feature a distribution of instances of the cache manager for two or more devices or components.

A preferred embodiment of the present invention may include a cache stored in a memory and components comprising computer readable instructions. Although not limited to the description below, non-limiting examples of memory include, but are not limited to, rewritable non-volatile memory devices (eg, flash memory devices, erasable programmable read-only memory devices, or mask read-only memory devices), volatile memory devices (eg, static random access memory devices (SRAM), dynamic random access memory devices (DRAM)), magnetic storage media (eg, analog or digital magnetic tape, hard disk drives) and optical storage media (eg, for example, a CD, DVD, or Blu-ray Disc). Examples of the memory in which the rewritable nonvolatile memory device is embedded may include, but is not limited to, a memory card and a medium in which a read only memory (ROM) is embedded. One embodiment includes random access memory (RAM), ROM, persistent mass storage (eg, disk drive) and/or any other similar data storage mechanism capable of storing and writing data. can do. The memory may be configured to store one or more operating systems and/or computer programs, program code, instructions, or combinations thereof for implementing the exemplary embodiments described herein. The memory may include a universal serial bus (USB) flash drive, a memory stick, a Blu-ray/DVD/CD-ROM drive, a memory card, and/or other similar computer-readable storage media. In one embodiment, the cache, computer program, program code, instructions, and/or combination thereof may be loaded from remote data storage devices via a network interface into one or more local memories and/or one or more local processors. . In one embodiment, the cache, computer program, program code, instructions, and/or combinations thereof may be loaded from other local memory and/or from another local processor or other component.

Although the present invention has been described above with respect to a particular exemplary computer architecture, caching may exist in many other settings, both internal to the computer system as well as external to the computer system, and the above embodiments are equally applicable to these other situations. An example of this use is a virtual memory system that caches data from a low-speed mass storage device such as disk or flash memory into a faster, smaller mass storage device that can be implemented using DRAM. Other examples of caching in computer systems may include, but are not limited to, disk caching, web caching, and name caching. The organization and caching mechanisms of such caches may differ from the cache configurations and caching mechanisms discussed above, eg, differences in size of sets, implementations of sets and associations, and the like. Regardless of the implementation of the caching mechanism itself, it is equally applicable to implementing various caching schemes.

Although the disclosed embodiments describe, for example, systems and methods related to various cache hierarchies, the embodiments of the present disclosure are not limited to the description, and the described embodiments include alternatives, modifications, etc., included within the spirit and scope of the present invention. and equivalents. Although features and elements of the present embodiment are described in specific combinations in the embodiments, each feature or element may be used alone without the other features and elements of the embodiment or in various combinations with or without other features and elements disclosed herein. The method or flowchart provided in the present application may be implemented as a computer program, software, or firmware tangibly embodied in a computer-readable storage medium for execution by a general-purpose computer or processor.

Although the present invention has been described with reference to the embodiments shown in the drawings, which are merely exemplary, those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Accordingly, the true technical protection scope of the present invention should be determined by the technical spirit of the appended claims.

Claims (15)

As a device to defend against cache-based side-channel attacks,
private cache; and
SRAM-based shared cache; including, and
A memory hierarchy is implemented to further include a shared DRAM cache. In this case, each cache block of the shared DRAM cache includes a bypass bit, and the bypass bit determines whether the attacker application performs a side-channel attack on the attacker application. A device for defending against a cache-based side-channel attack, characterized in that it displays. The method of claim 1,
The bypass bit value checked when loading at least one cache block from the shared DRAM cache is 1, and in the case of a cache block in which a side channel attack is confirmed, the shared final level cache* is bypassed and loaded into the private cache,
A device for preventing a cache-based side-channel attack, characterized in that in the case of a cache block in which a side-channel attack is not confirmed as the bypass bit value is 0, the SRAM-based shared cache is loaded. 3. The method of claim 2, wherein the private cache is
L1 cache or L2 cache, wherein the private cache further includes a bypass bit, and the bypass bit in the private cache changes the bypass bit value from 0 to 1 when loading a cache block in which a side-channel attack is confirmed. A device for defending against a cache-based side-channel attack, characterized in that. As a device to defend against cache-based side-channel attacks,
private cache; and
SRAM-based shared cache; including, and
A shared DRAM cache; implements a memory hierarchy to further include,
The private cache and the shared DRAM cache include a bypass bit, and by using the bypass bit value, the attacker application determines whether a side-channel attack on the attacker application is performed,
When the attacker application performs a flush attack and then reloads, at least one cache block that has performed a flush attack is all loaded in the shared DRAM cache. At least one cache in which the attacker application performs a flush attack Apparatus for preventing a cache-based side-channel attack, characterized in that the access pattern and execution pattern of the attacked application cannot be determined because the access time to the block is the same regardless of whether the attacked application is accessed. The method of claim 4, wherein the attacked application is
A cache-based side-channel attack characterized in that each cache block is loaded into the private cache or the SRAM-based shared cache of the attacked application according to the bypass bit value of each at least one cache block in the shared DRAM cache. defense device. 6. The method of claim 5,
The bypass bit value of each of the at least one cache block in the shared DRAM cache is displayed as a value of 1 when the attacker application performs a flush-reload attack on the attacked application, otherwise a value of 0 A device that protects against cache-based side-channel attacks, characterized in that indicated by 6. The cache block according to claim 5, wherein the bypass bit value is 1,
It bypasses the shared cache and is loaded into the private cache of the attacked application core, and the bypass bit value in the private cache is changed to 1. 6. The cache block of claim 5, wherein the bypass bit value is 0.
A device for defending against a cache-based side-channel attack, characterized in that it is loaded into the shared cache of the attacker application. 5. The method of claim 4,
The attacker application performs the flush attack using the clflush command,
When the clflush command is executed, the cache blocks in the private cache and the shared cache may be evicted, but the cache blocks in the shared DRAM cache are not evicted, and only whether the clflush has been performed is displayed using the bypass bit. A device for defending against a cache-based side-channel attack, characterized in that. As a method of defending against a cache-based side-channel attack,
using a memory hierarchy including a private cache, an SRAM-based shared cache, and a shared DRAM cache;
displaying whether a flush attack has been performed on the attacker application by the attacker application using the bypass bit included in the cache block of the shared DRAM cache;
when the attacked application loads at least one cache block from the shared DRAM cache, checking each of the bypass bits in the at least one cache block; and
As a result of checking the bypass bit, the cache block on which the flush attack is performed bypasses the SRAM-based shared cache and is loaded into the private cache of the attacked application core, and the cache block for which the flush attack is not detected is the SRAM-based shared cache. Loading into the cache; Method comprising the. 11. The method of claim 10,
The attacker application can execute the flush attack by using the clflush command. In this case, the blocks in the private cache and the SRAM-based shared cache of the attacked application are evicted, but the blocks in the shared DRAM cache are evicted. not done,
and providing information on whether the flush attack is executed using a bypass bit in a cache block in the shared DRAM cache. 11. The method of claim 10, wherein a value of the bypass bit in the cache block in the shared DRAM cache is "1", indicating that a flush attack has been performed, and in this case, the private cache has a value of the bypass bit equal to "1". The method of claim 1, wherein the bypass bit value in the private cache is also displayed as "1" while loading the cache block in the shared DRAM cache. 12. The method of claim 11,
When the attacker application performs a flush attack and then reloads, at least one cache block that has performed a flush attack is all loaded in the shared DRAM cache. At least one cache in which the attacker application performs a flush attack A method characterized in that it is impossible to determine the access pattern and execution pattern of the attacked application because the access time to the block is the same regardless of whether the attacked application accesses or not. 11. The method of claim 10,
The private cache is an L1 cache or an L2 cache,
The SRAM-based shared cache is an L3 cache,
The method of claim 1, wherein the shared DRAM cache is an L4 cache. A computer-readable storage medium, characterized in that a program for executing the method for defending against a cache-based side-channel attack according to any one of claims 10 to 14 is recorded.

Images