Cips: The Cache Intrusion Prevention System

Caches are an essential component in the performance-driven memory hierarchy of modern CPUs. However, they are also known to be vulnerable against a variety of timing side-channel attacks like Prime+Probe, Flush+Reload, and others. These allow attackers to leak sensitive information across process boundaries. While detection-based approaches have proven capable of identifying cache attacks, it remains unclear how to handle a potentially malicious application once it has been classified as such. In particular, in environments with strict requirements on safety or availability, the termination of a potentially malicious process is not a viable option. In this paper we present Cips, a hardware-based Intrusion Prevention System (IPS) for cache attacks. Cips combines a lightweight hardware-based attack detection mechanism with a set of non-disruptive attack prevention techniques. Hence, when a potentially malicious process is detected Cips automatically activates appropriate countermeasures to stop the attack without interrupting the process. Our design only affects the performance when a potential attack is detected, and the effect is limited to the attacked cache sets. We implement Cips in gem5, provide a hardware prototype, and demonstrate its effectiveness against state-of-the-art cache attacks.