Bespoke Cache Enclaves: Fine-Grained and Scalable Isolation from Cache Side-Channels via Flexible Set-Partitioning
- 1 September 2021
- conference paper
- conference paper
- Published by Institute of Electrical and Electronics Engineers (IEEE)
Abstract
Cache partitioning is a principled defense against side-channel attacks on shared last-level caches (LLCs). Such defenses allocate isolated cache regions to distrusting applications and prevent a spy from monitoring the cache accesses of a victim. But current solutions have severe practical limitations. Way-partitioning is not scalable as the number of partitions is limited by cache associativity and page-coloring is inflexible as it requires coupled DRAM and LLC allocations in the same ratio. For cache partitioning to be practical, we need a scheme that can scale to a large number of fine-grained partitions and places no restrictions on DRAM allocations.This paper proposes Bespoke Cache Enclaves (BCE), a secure cache partitioning substrate that is scalable in supporting hundreds of isolated cache partitions and is flexible in allocating cache space independent of memory allocations. BCE allocates cache space at the granularity of a cluster, a group of a few sets (e.g., 64 KB in size). The key insight of BCE is a configurable cache indexing function (determining the line to set mapping) that guides cache lines of a domain to only the allocated cache sets, enabling flexible set-partitioning independent of memory allocations. BCE achieves this by modifying the cache indexing hardware to include a Cluster-Indirection Module (CIM), which maps logical-to-physical clusters of a domain and a Load-Balancing Hash (LBH), which uniformly distributes lines of a domain among its clusters. Our implementation of BCE with a 32MB 16-way LLC scalably supports up to 512 isolated partitions while incurring negligible storage overheads (<2%) and slowdown (1% on average) compared to a non-secure unpartitioned LLC.Keywords
This publication has 36 references indexed in Scilit:
- Last-Level Cache Side-Channel Attacks are PracticalPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2015
- COLORISPublished by Association for Computing Machinery (ACM) ,2014
- Meeting midway: improving CMP performance with memory-side prefetchingPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2013
- Probabilistic Shared Cache Management (PriSM)Published by Institute of Electrical and Electronics Engineers (IEEE) ,2012
- Non-monopolizable cachesACM Transactions on Architecture and Code Optimization, 2012
- High performance cache replacement using re-reference interval prediction (RRIP)ACM SIGARCH Computer Architecture News, 2010
- Cache Attacks and Countermeasures: The Case of AESLecture Notes in Computer Science, 2006
- PinACM SIGPLAN Notices, 2005
- Automatically characterizing large scale program behaviorACM SIGPLAN Notices, 2002
- Universal classes of hash functionsJournal of Computer and System Sciences, 1979