Hardware-assisted obscuring of cache access patterns

Patent metadata

Field	Value
Publication number	US-11972034-B1
Application number	US-202017084336-A
Country	US
Kind code	B1
Filing date	Oct 29, 2020
Priority date	Oct 29, 2020
Publication date	Apr 30, 2024
Grant date	Apr 30, 2024

Abstract

A computer system and associated methods are disclosed for mitigating side-channel attacks using a shared cache. The computer system includes a host having a main memory and a shared cache. The host executes a virtual machine manager (VMM) that determines respective security keys for a plurality of co-located virtual machines (VMs). A cache controller for the shared cache includes a scrambling function that scrambles addresses of memory accesses performed by threads of the VMs according to the respective security keys. Different cache tiers may implement different scrambling functions optimized to the architecture of each cache tier. Security keys may be periodically updated to further reduce predictability of shared cache to memory address mappings.

First claim

What is claimed is:

1. A system, comprising:
a hardware processor and memory;
a cache controller configured to utilize a plurality of security keys, comprising a first security key and a second security key different from the first security key, to perform respective memory accesses, including a first access and a second access, for respective ones of a plurality of different threads comprising a first thread of execution and a second thread of execution, wherein the first thread of execution is a member of a first security group, wherein the second thread of execution is a member of a second security group, and wherein to utilize the plurality of security keys the cache controller is configured to:
receive a first access to an address of the memory from the first thread of execution executing on the hardware processor and associated with the first security group, and responsive to the receiving the first access:
identify the first security key according to an identifier of the first security group;
scramble a portion of the address of the memory according to the selected first security key using a first scrambling function to generate a first index; and
identify a first set of candidate cache locations mapping to the address of the memory using the generated first index; and

receive second access to another address of the memory from the second thread of execution executing on the hardware processor and associated with the second security group, and responsive to the receiving the second access:
identify the second security key according to an identifier of the second security group;
scramble the portion of the other address of the memory according to the selected second security key using the first scrambling function to generate a second index; and
identify a second set of candidate cache locations mapping to the address of the memory using the generated second index, wherein the second security key differs from the first security key, wherein the second index differs from the first index according to a difference between the second security key and the first security key, and wherein the second set of candidate cache locations differs from the first set of candidate cache locations.

2. The system of claim 1 , the cache controller further configured to:
receive an access to the address of the memory from the first thread of execution associated with a third security key;
scramble the portion of the address of the memory according to the third security key using a second scrambling function to generate a third index;
identify a third set of candidate cache locations mapping to the address of the memory using the generated third index, wherein the first and second set of candidate cache locations are of a first cache tier different from a second cache tier, and wherein the second scrambling function is different from the first scrambling function.

3. The system of claim 2 , the cache controller further configured to:
change the first and second security keys of the first scrambling function according to a first time interval;
change the third security key of the second scrambling function according to a second time interval different from the first time interval, wherein first and second scrambling functions use different respective security keys based at least in part on respective identifiers of the respective security groups.

4. The system of claim 1 , the cache controller further configured to:
determine one of a plurality of cache partitions using the first scrambling function.

5. A method, comprising:
utilizing a plurality of security keys, comprising a first security key and a second security key, to perform respective memory accesses for respective ones of a plurality of security groups comprising a first security group and a second security group, the utilizing of the plurality of security keys comprising:
identifying a first set of candidate cache locations mapping to a memory address according to the first security key of the first security group, the memory address accessed by a first thread of execution of a processor as a member of the first security group and the first security key identified according to an identifier of the first security group, wherein the identifying comprises scrambling a portion of the memory address according to the selected first security key using a first scrambling function to generate a first index; and
identifying a second set of candidate cache locations mapping to another memory address according to the second security key of the second security group, the other memory address accessed by a second thread of execution of a processor as a member of the second security group and the second security key identified according to an identifier of the second security group, wherein the identifying comprises scrambling a portion of the other memory address according to the second security key using the first scrambling function to generate a second index, wherein the second security group differs from the first security group, wherein the second security key differs from the first security key, wherein the second thread of execution differs from the first thread of execution, and wherein the second set of candidate cache locations differs from the first set of candidate cache locations according to a difference between the second security key and the first security key.

6. The method of claim 5 ,
wherein identifying the first set of candidate cache locations mapping to the memory address comprises determining a first index using a first scrambling function that alters a portion of the memory address according to the first security key selected at least in part on an identifier of the first security group; and
wherein identifying the second set of candidate cache locations mapping to the memory address comprises determining a second index using the first scrambling function that alters the portion of the memory address according to the second security key selected at least in part on an identifier of the second security group.

7. The method of claim 6 , further comprising:
determining a cache performance metric for a cache comprising the first and second set of candidate cache locations; and
changing the respective security keys of the first scrambling function according to a determined cache performance metric.

8. The method of claim 6 , further comprising:
changing the respective security keys of the first scrambling function according to a first time interval.

9. The method of claim 6 , further comprising:
determining a third set of candidate cache locations of a second cache tier mapping to the memory address according to the first security group using a second scrambling function, wherein the first and second set of candidate cache locations are of a first cache tier different than the second cache tier, and wherein the second scrambling function is different from the first scrambling function.

10. The method of claim 9 , further comprising:
changing the respective security keys of the second scrambling function according to a second time interval different from the first time interval, wherein first and second scrambling functions use different respective security keys based at least in part on respective identifiers of the respective security groups.

11. The method of claim 6 , the identifying the respective sets of candidate locations further comprising:
determining a cache partition of a plurality of cache partitions according to the first security key, wherein the cache partition comprises the first set of candidate cache locations.

12. The method of claim 5 , wherein the memory address is a vir

Assignees

• Amazon Tech Inc

Inventors

• Pohlack Martin
• Wieczorkiewicz Pawel
• Dannowski Uwe

Classifications

• G06F21/79 Primary

  in semiconductor storage media, e.g. directly-addressable memories · CPC title

• G06F12/084

  with a shared cache · CPC title

• G06F12/0848

  Partitioned cache, e.g. separate instruction and operand caches · CPC title

• G06F12/1466

  Key-lock mechanism · CPC title

• G06F21/54 Primary

  by adding security routines or objects to programs · CPC title