# Randomized Last-Level Caches Are Still Vulnerable to Cache Side-Channel Attacks! But We Can Fix It

**Authors:** Wei Song, Boya Li, Zihan Xue, Zhenzhen Li, Wenhao Wang, Peng Liu  
**arXiv:** [2008.01957](https://arxiv.org/abs/2008.01957)  
**Date:** 2020-08-05  
**Summary page:** https://www.summarizepaper.com/en/paper/2008.01957v1/

## Key points

- Cache randomization is a potential solution to combat conflict-based cache side-channel attacks
- CEASER-S and ScatterCache are two recent implementations of randomized skewed caches that claim to mitigate these attacks
- However, CEASER-S is susceptible to attack due to a usable eviction set being found within the chosen remap period
- Increasing the number of partitions without dynamic remapping, as done in ScatterCache, does not eliminate the threat
- Quantitative analysis of access patterns in the Last-Level Cache (LLC) reveals issues with hypotheses and implementations of randomized caches
- Despite challenges, cache randomization remains a viable defense mechanism and should be widely adopted in future processors
- The paper proposes new defense techniques that address vulnerabilities associated with existing cache randomization implementations
- These newly discovered flaws can be resolved within the current performance budget
- Randomized set-associative caches offer a better chance of adoption in commercial processors compared to skewed counterparts
- This study highlights the need for refinement and improvement in existing cache randomization techniques but reaffirms its effectiveness as a defense strategy against conflict-based cache side-channel attacks.

## Summary

, , , , 

Cache randomization has emerged as a potential solution to combat conflict-based cache side-channel attacks. Two recent implementations, CEASER-S and ScatterCache, have claimed to effectively mitigate these attacks by using randomized skewed caches. However, our experiments reveal that CEASER-S is susceptible to attack due to a usable eviction set being found within the chosen remap period. Additionally, increasing the number of partitions without dynamic remapping, as done in ScatterCache, does not eliminate the threat. Through quantitative analysis of access patterns left by various attacks in the Last-Level Cache (LLC), we have identified several issues with the hypotheses and implementations of randomized caches. These problems have been overlooked in previous research on conflict-based cache side-channel attacks. Despite these challenges, we assert that cache randomization remains a viable defense mechanism and should be widely adopted in future processors. In this paper, we propose several new defense techniques that address the vulnerabilities associated with existing cache randomization implementations. Importantly, our experiments demonstrate that all these newly discovered flaws can be resolved within the current performance budget. Furthermore, we argue that randomized set-associative caches offer a better chance of adoption in commercial processors compared to their skewed counterparts. This is because they introduce less overhaul to the existing cache structure while still providing sufficient strengthening against cache side-channel attacks. Overall, this study highlights the need for refinement and improvement in existing cache randomization techniques but reaffirms its effectiveness as a defense strategy against conflict-based cache side-channel attacks.