How does cache partitioning prevent covert/side-channel attacks?

Question

In a report on an open-source separation kernel (Muen kernel) I was reading, in the future work section, it says that cache coloring can be implemented to prevent covert/side-channel attacks.

It is mentioned that

In a second step each subject is associated with a color. All subjects of a given color share the same cache partition. In turn subjects of differing color have no access to identical cache locations, which means the cache cannot be used as a side-channel.

I understand what page coloring/cache partitioning is, but I do not understand how having different subjects use different cache partitions can solve side-channel attacks. Can anyone enlighten me on this?

Answer 1

Most L2 (and L3) caches are indexed with the physical (not virtual) address modulo a power of two that is larger than the page size. This allows different physical address colors to map to different indices, isolating replacement decisions (i.e., only accesses from the same color can cause a cache miss). The added latency from cache misses (often measured in the attacker program) can reveal the index of cache line that was replaced.

Partitioning also avoids capacity use measurement, which provides less specific information (compared to used index).

Color-based partitioning would typically not avoid bandwidth use measurement in a shared cache under default hardware configurations (which tend to be demand-based rather than fair-share; strict fair-share decreases throughput under variable demand).

For L1 caches, isolation based on physical page color would have no effect in caches that are virtually indexed. L1 sharing is more easily restricted to a temporal granularity that would not leak a significant amount of information.

It might be noted that performance isolation for multi-use systems (where different uses may give different values to different resources and even to the predictability of resource availability) is the primary/original motivation for Intel's Cache Allocation Technology ("ensuring consistent performance and prioritizing important interactive applications"), but such features can help narrow side-channels for security-oriented isolation.