Hardware Security
What is the idea of partitioning a shared cache as a countermeasure to cache side channels?
- APhysically splitting the cache in two and discarding it
- BDoubling the cache capacity
- CAssigning separate cache regions to processes or VMs so they cannot evict each other's data, making traces unobservable
Show answer and explanation
Answer: C. Assigning separate cache regions to processes or VMs so they cannot evict each other's data, making traces unobservable
Cache side channels work because attacker and victim contend for the same cache locations. Assigning certain ways or sets of the cache to each process or VM prevents them from evicting each other's data, so the other party's access traces cannot be observed. Some CPUs offer features to control cache allocation. Each party gets less capacity, though, so it is a trade-off with performance.
- A. It is not physical splitting.
- B. More capacity still leaves traces if shared.
- C. Correct. In exchange, each gets less cache.