Secure Caches for Compartmentalized Software
summary
Framework SEC (aka SCC) isolates caches by domain-oriented partitioning, adds an active domain register (ADR) to keep L1 hits at baseline, and creates per-caller library instances to stop library-based probes. Implemented in gem5, evaluated on MIBench and SPEC17 using SOAP-generated compartments, formally proven secure, and compared against full/partial cache flushes. Results show ~7% average slowdown (vs 32–60% for flushes) and about 63% hardware area overhead; the design works and avoids cache-coherence aliasing for shared domains.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 0:34Motivation and challenges
- 1:59Hardware cache vulnerabilities
- 3:23Cache partitioning against side channels
- 4:05Domain oriented partitioning
- 6:08Optimizing L1 cache latency
- 8:56Mitigating library side channels
- 10:22SEC in multiprocess environments
- 11:04SEC performance evaluation
- 13:11Summary and future directions
related talks
19mCoSMIX: A Compiler-based System for Secure Memory Instrumentation and Execution in Enclaves
28mSanctum: Minimal Hardware Extensions for Strong Software Isolation
28mStrong and Efficient Cache Side-Channel Protection...
21mScaling Data Analytics Via Confidential Computing on RISC-V
52mEnabling New Security Frontiers: Deep-Dive Into Implementing Confidential Computing on RISC-V
18mCPU Security in the Context of RISC-V
15mMy Journey in Secure Compilation
15mSpecSafe: Detecting Cache Side Channels in a Speculative World