These Aren’t The Caches You’re Looking For: Stochastic Channels on Randomized Caches

Many security attacks utilize cache side-channels to subvert memory security mechanisms. By exploiting co-resident processes that share the cache, attackers simply monitor and manipulate their own cache state to infer activities of victim processes, exfiltrate program secrets, or establish unauthorized communication channels. To counter these unwanted cache channels, defenses that randomize line address to cache set mappings have emerged. In this paper, we present a novel cache communication technique based on stochastic channels, which are probabilistically formed and evicted to establish communication. The approach is coupled with noise reduction techniques in order to tolerate system noise and the cases where probabilistic channels do not form. Since the approach is stochastic, it is agnostic to the cache-indexing mechanism; thus, cache randomization defenses, including those with re-mapping capabilities, have little effect on this channel. We demonstrate the covert communication channel working seamlessly on real-world caches, randomized cache designs proposed in literature, and futuristic randomized caches. We then demonstrate the applicability of our error-resilient covert channel with the Spectre attack on randomized caches. We close by noting that stochastic cache channels suggest that randomized caches are not a durable defense against covert cache communication, and we advocate for the community to focus on cache partitioning technologies and novel defenses such as in-cache encryption and side-channel resistant accelerators.