论文标题
海市rage楼：通过实用的完全缔合设计来缓解基于冲突的缓存攻击
MIRAGE: Mitigating Conflict-Based Cache Attacks with a Practical Fully-Associative Design
论文作者
论文摘要
共享的处理器缓存容易受到基于冲突的侧通道攻击，攻击者可以通过使用缓存冲突驱逐受害者缓存线来监视受害者的访问模式。最近的缓解提出了将地址的随机映射到缓存线，以混淆设定冲突的位置。但是，尽管这些设计减轻了这种缓解，但这些设计很容易受到发现发现相互矛盾地址的新攻击，因为这些设计从一小部分冲突的线路中选择了驱逐candication。 本文介绍了Mirage，这是一种完全关联的缓存的实用设计，其中从缓存中居民的所有线路随机选择了驱逐候选者，以免对集合冲突。在大型共享缓存中启用此类设计的主要挑战（包含数以万计的高速缓存线）是缓存外观的复杂性，因为天真的设计可能需要通过所有居民线进行搜索。 Mirage使用从标记店到数据商店的基于Pointer的间接方向来保留实用的设置缔合查找，同时保持实用的设置相关查找，从而允许新安装的地址以全球范围驱逐任何随机居民线的数据。为了消除设置冲突，Mirage Provisions在偏斜的缔合标签店设计中额外的无效标签，可以在没有设置冲突的情况下安装线路，以及负载吸引的偏斜选择策略，可确保使用无效标签的设置可用性。我们的分析表明，Mirage提供了整个系统寿命中完全缔合性缓存的全球驱逐性能（违反全面缔合性的行为，即设定冲突，在10^4到10^17年中发生了不到一次），从而为任何驱逐设定发现和任何潜在的基于冲突的攻击提供了原则上的辩护。与非安全缓存相比，幻影会导致有限的放缓（2％）和17-20％的额外存储空间。
Shared processor caches are vulnerable to conflict-based side-channel attacks, where an attacker can monitor access patterns of a victim by evicting victim cache lines using cache-set conflicts. Recent mitigations propose randomized mapping of addresses to cache lines to obfuscate the locations of set-conflicts. However, these are vulnerable to new attacks that discover conflicting sets of addresses despite such mitigations, because these designs select eviction-candidates from a small set of conflicting lines. This paper presents Mirage, a practical design for a fully associative cache, wherein eviction candidates are selected randomly from all lines resident in the cache, to be immune to set-conflicts. A key challenge for enabling such designs in large shared caches (containing tens of thousands of cache lines) is the complexity of cache-lookup, as a naive design can require searching through all the resident lines. Mirage achieves full-associativity while retaining practical set-associative lookups by decoupling placement and replacement, using pointer-based indirection from tag-store to data-store to allow a newly installed address to globally evict the data of any random resident line. To eliminate set-conflicts, Mirage provisions extra invalid tags in a skewed-associative tag-store design where lines can be installed without set-conflict, along with a load-aware skew-selection policy that guarantees the availability of sets with invalid tags. Our analysis shows Mirage provides the global eviction property of a fully-associative cache throughout system lifetime (violations of full-associativity, i.e. set-conflicts, occur less than once in 10^4 to 10^17 years), thus offering a principled defense against any eviction-set discovery and any potential conflict based attacks. Mirage incurs limited slowdown (2%) and 17-20% extra storage compared to a non-secure cache.
