5
$\begingroup$

In a report on an open-source separation kernel (Muen kernel) I was reading, in the future work section, it says that cache coloring can be implemented to prevent covert/side-channel attacks.

It is mentioned that

In a second step each subject is associated with a color. All subjects of a given color share the same cache partition. In turn subjects of differing color have no access to identical cache locations, which means the cache cannot be used as a side-channel.

I understand what page coloring/cache partitioning is, but I do not understand how having different subjects use different cache partitions can solve side-channel attacks. Can anyone enlighten me on this?

$\endgroup$
  • $\begingroup$ Maybe more suitable for the InfoSec SE? $\endgroup$ – xuq01 Jul 8 '18 at 16:29
  • $\begingroup$ @xuq01 Okay, I will post there, thanks. $\endgroup$ – nj2237 Jul 8 '18 at 18:29
  • $\begingroup$ @xuq01, may I make a request for the future? In the future, if you suggest another site, can I ask you to let the poster know that cross-posting is not allowed? You can suggest they delete the copy here before posting on a different site. Hopefully this will provide a better experience for both posters and answerers. Thank you for listening! $\endgroup$ – D.W. Jul 9 '18 at 3:15
4
$\begingroup$

Most L2 (and L3) caches are indexed with the physical (not virtual) address modulo a power of two that is larger than the page size. This allows different physical address colors to map to different indices, isolating replacement decisions (i.e., only accesses from the same color can cause a cache miss). The added latency from cache misses (often measured in the attacker program) can reveal the index of cache line that was replaced.

Partitioning also avoids capacity use measurement, which provides less specific information (compared to used index).

Color-based partitioning would typically not avoid bandwidth use measurement in a shared cache under default hardware configurations (which tend to be demand-based rather than fair-share; strict fair-share decreases throughput under variable demand).

For L1 caches, isolation based on physical page color would have no effect in caches that are virtually indexed. L1 sharing is more easily restricted to a temporal granularity that would not leak a significant amount of information.

It might be noted that performance isolation for multi-use systems (where different uses may give different values to different resources and even to the predictability of resource availability) is the primary/original motivation for Intel's Cache Allocation Technology ("ensuring consistent performance and prioritizing important interactive applications"), but such features can help narrow side-channels for security-oriented isolation.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.