SoK: So, You Think You Know All About Secure Randomized Caches?
summary
Systematic evaluation isolates five concrete knobs—skewing, extra invalid tags, high associativity, replacement policy, and remapping—and measures eviction rate and number of LLC evictions to build an eviction set. No single knob suffices; invalid tags only cut eviction rates when paired with load-aware skew selection and global eviction. Raising associativity to 128-way associativity drastically lowers evictions. Deterministic/globalized replacement beats random for conflict attacks, while random helps occupancy attacks; remapping costs fall when using faster config-testing (10×+ over probe).
AI-written summary · about
chapters (13)
- 0:00Secure randomized caches intro
- 0:52How caches work & attacks
- 2:19Secure cache designs flaws
- 3:22Systematizing secure cache design
- 4:03Measuring security eviction
- 5:05Skewing as security knob
- 6:08Extra valid tags impact
- 7:12High associativity security
- 7:55Replacement policies randomized
- 8:59Remapping frequency trade-offs
- 10:01Occupancy-based attacks security
- 11:03Cache warm-up state effect
- 13:12Design trade-offs conclusion
related talks
39mSecure Cache Designs: State of the Art and ...
13mExposing Cache Timing Side-Channel Leaks through Out-of-Order Symbolic Execution
37mDerandomizing Kernel Object Locations w Software Hardware-Induced Side Channels
41mA General Approach to Bypassing Many Kernel Protections and its Mitigation
30mProactive Software Defense against Side Channel Attacks
35mOn Securing Legacy Software Against Code-Reuse Attacks
42mSRAM Data Remanence In SoCs: Covert Storage And Exfiltration Risks In TEE
23mMalicious Management Unit: Why Stopping Cache Attacks in Software is Harder Than You Think