SEA Cache: A Performance-Efficient Countermeasure for Contention-based Attacks

Xiao Liu,Mark Zwolinski,Basel Halak

2024-05-30

Abstract:Many cache designs have been proposed to guard against contention-based side-channel attacks. One well-known type of cache is the randomized remapping cache. Many randomized remapping caches provide fixed or over protection, which leads to permanent performance degradation, or they provide flexible protection, but sacrifice performance against strong contention-based attacks. To improve the secure cache design, we extend an existing secure cache design, CEASER-SH cache, and propose the SEA cache. The novel cache configurations in both caches are logical associativity, which allows the cache line to be placed not only in its mapped cache set but also in the subsequent cache sets. SEA cache allows each user or each process to have a different local logical associativity. Hence, only those users or processes that request extra protection against contention-based attacks are protected with high logical associativity. Other users or processes can access the cache with lower latency and higher performance. Compared to a CEASER-SH cache with logical associativity of 8, an SEA cache with logical associativity of 1 for normal protection users and 16 for high protection users has a Cycles Per Instruction penalty that is about 0.6% less for users under normal protections and provides better security against contention-based attacks. Based on a 45nm technology library, and compared to a conventional cache, we estimate the power overhead is about 20% and the area overhead is 3.4%.

Cryptography and Security,Hardware Architecture

What problem does this paper attempt to address?

### What problem does this paper attempt to solve?

This paper aims to solve the problem of the balance between security and performance in cache design against contention - based side - channel attacks. Specifically, the paper proposes a new cache architecture - SEA Cache (Skewed Elastic - Associativity Cache) to improve the performance degradation problem of existing secure cache designs when dealing with strong contention attacks.

#### Main problem description

1. **Limitations of existing cache designs**:
- Many randomly remapped caches provide fixed or excessive protection, resulting in permanent performance degradation.
- Designs that provide flexible protection sacrifice performance when facing strong contention attacks.
- Although the CEASER - SH cache enhances security through logical associativity, high logical associativity will cause all users to face high access latency, thus limiting the overall performance.

2. **Threats of contention attacks**:
- Contention attacks (such as Prime + Probe attacks) take advantage of the characteristics of cache - shared resources and infer other users' sensitive data by observing cache activities.
- These attacks are particularly serious in cloud computing environments because multiple users share the same cache resource, and attackers can use this to steal information without being detected.

3. **Trade - off between security and performance**:
- Existing solutions either provide strong security protection but sacrifice performance, or provide high performance but are not sufficient to resist strong contention attacks.
- A design that can flexibly adjust security and performance among different users is needed to meet the different needs of users.

#### Solution

The SEA Cache proposed in the paper allows different users to choose different protection levels according to their own needs by introducing logical associativity and user alienation mechanisms:

- **Logical associativity**: Each cache line can be placed not only in its mapped cache set but also in subsequent cache sets. This enables some users to obtain higher logical associativity when needed, thereby enhancing security.
- **User alienation**: Different users or processes can choose different logical associativity settings. Only those users or processes that request additional protection will be affected by high logical associativity, while other users or processes can maintain lower latency and higher performance.

#### Results

Compared with the CEASER - SH cache, the SEA Cache shows advantages in the following aspects:

- For users with normal protection, the instruction cycle penalty is reduced by approximately 0.6%.
- In the 45nm technology library, compared with the traditional cache, the power overhead is approximately 20% and the area overhead is 3.4%.
- In terms of countering contention attacks, the security of the SEA Cache is improved by about 20 times, significantly reducing the success rate of attacks.

In this way, the SEA Cache achieves a better balance between security and performance, especially suitable for multi - user scenarios in cloud computing environments.