New Intel CPU Cache Architecture Boosts Protection Against Side-Channel Attacks

[SumG]

Intel released a new CPU model this week, the Intel Core i9 7900X, which is the latest model to feature a new cache architecture that hardware experts believe it will make exploitation of side-channel attacks a lot harder.

This improvement in CPU security is attributed to a new cache architecture that Intel developed for the Knights micro architecture and Skylake server CPU models, and which Intel added to i9, a line of CPU models for HEDT (High-End-DeskTop) products.

Intel makes a small change to cache architecture
The changes to Intel's previous cache architecture are small. The structure has remained the same, with three levels as before.

The new Intel CPU cache architecture quadruples the size of L2 and makes L3 a non-inclusive cache.

Previously L3 was an inclusive cache, meaning the same data could have been loaded in multiple caches on different cores at the same time. Intel did this for the sake of processing speed.

The new L3 cache is now non-inclusive, meaning data in L3 will not be cached in other caches at the same time.

Researcher says new cache architecture is good for security
According to G Data Principal Malware Analyst Anders Fogh, this small change in cache architecture has improved the CPU's security, as it thwarted some types of side-channel attacks.

The term of side-channel attack is used to define a type of attack used for leaking data from a computer's memory or CPU, usually focused on leaking data specific to encrypted operations.

The researcher believes this new cache architecture will block Flush+Flush attacks and some of the Rowhammer attacks, but not CLFlush and Flush+Reload.

"Having a non-inclusive L3 cache is significantly more secure from a side channel perspective than an inclusive in cross core scenarios," Fogh explains.

"This opens up for defending these attacks, by isolating different security domains on different cores potentially dynamically," Fogh also adds. "While flush+reload is likely to be unaffected, this attack is also the easiest to thwart in real life scenarios as avoiding shared memory cross security domains is an available and effective countermeasure."

Despite the improvements, Fogh doesn't see this new cache architecture trickling down to mid and low-end notebooks and laptops anytime soon.

Nonetheless, most side-channel attacks are developed and aimed at high-end server products, usually deployed in cloud and hosting environments, where a side-channel attack could allow an attacker access to troves of enterprise data stored in the cloud.

Last year, Fogh authored a research paper that showed how the design of DRAM memory makes devices insecure.

Source: New Intel CPU Cache Architecture Boosts Protection Against Side-Channel Attacks​