Source-linked AI summary
HermiCache: Enclave-Aware Cache Replacement for Trusted Execution Environments
Oussama Elmnaouri, Pascal Cotret, Vianney Lapôtre, Loïc Lagadec
TL;DR
TEEs remain vulnerable to cache-based side-channel attacks, and existing defenses involve tradeoffs in configuration, capacity, or cache-management logic. HermiCache introduces hardware-enforced ownership-based cache isolation for RISC-V TEEs, implemented with CVA6 and Keystone. In contention experiments, protected-line eviction fell to 0%, with 1.27% LUT and 3.1% flip-flop increases.
Problem
TEEs remain vulnerable to cache-based side-channel attacks through shared caches, while existing defenses impose practical tradeoffs.
Method
HermiCache uses hardware-enforced isolation with ownership-based cache-line replacement for a RISC-V CVA6 core integrated with Keystone.
Results
0% of protected victim-line evictions occurred with HermiCache in same-set contention, compared with 100% for LRU and 58% for random replacement.
Takeaways & Limitations
HermiCache provides cache protection for TEEs with low reported area and IPC overheads.
Abstract
from arXiv · showhide
Trusted Execution Environments (TEEs) protect enclave memory from untrusted software but remain vulnerable to cache-based side-channel attacks due to shared microarchitectural resources. Existing countermeasures use techniques such as cache partitioning or randomization: these solutions are not ideal if a designer wants fine-grained configurations and a deterministic protection. In this paper, we introduce HermiCache which is an answer to these requirements. HermiCache is designed for RISC-V cores and has been implemented in the OpenHwGroup CVA6 core with a Keystone TEE for the software layer. The solution has an area overhead of 6% on the processor core.
I. INTRODUCTION
TEEs isolate enclave code and data but remain exposed to cache-based side channels, while existing software and hardware defenses involve usability, capacity, or logic tradeoffs. HermiCache addresses this gap through hardware-enforced isolation, an ownership-based replacement mechanism, a CVA6/Keystone implementation, and quantitative evaluation.
- Shared-cache attacks can retrieve victim information, while constant-time programming, partitioning, and randomization impose practical tradeoffs.
- HermiCache provides hardware-enforced isolation for TEEs against cache-based side-channel attacks.
- The proposed ownership-based replacement mechanism is a central contribution of HermiCache.
- The design is implemented in a RISC-V CVA6 core integrated with a Keystone TEE.
- The evaluation combines FPGA synthesis with gem5 simulations.
A. Threat model
HermiCache follows the Keystone threat model, trusting the processor, cache hierarchy, and Security Monitor while treating other software as untrusted. It covers cache attacks but excludes several other microarchitectural and physical attack classes.
- The trusted base comprises the processor, cache hierarchy, and Keystone Security Monitor, while operating systems and REE applications are untrusted.
- The attacker may execute untrusted code and perform Prime+Probe, Evict+Time, and Flush+Reload cache attacks.
- HermiCache does not protect against TLB or branch-predictor side channels and excludes physical attacks.
B. Design
HermiCache adds ownership metadata and an ownership-aware replacement policy to isolate enclave cache lines. Keystone configures ownership through trusted CSRs, with Figure 1 describing secure-miss victim selection and Figure 2 depicting configuration.
- Each cache line stores a security flag and an Enclave Identifier to represent HermiCache protection and enclave ownership.
- For secure misses, replacement prioritizes invalid entries, current-enclave lines, and non-protected lines before bypassing allocation when no eligible victim exists.
- The Keystone Security Monitor assigns an EID and configures the security flag through trusted CSR registers added to the CVA6 core.
- The default 4-bit EID configuration supports 15 protected identifiers plus one identifier for non-secure execution.
III. EVALUATION
HermiCache was implemented in a CVA6-based Keystone SoC and evaluated for resource overhead and cache-isolation effectiveness. The reported results show modest implementation costs and zero protected-line evictions in the contention experiment.
- The implementation used a CVA6-based Keystone SoC on a Digilent Genesys2 XC7K325T FPGA with 16KB instruction and 32KB data L1 caches.
- Table I reports post-implementation resource, timing, and power overhead for HermiCache.
- 0% of protected victim lines were evicted with HermiCache, versus 100% with LRU and 58% with random replacement.The same-set contention experiment compared attacker-induced eviction across the three replacement policies.
- HermiCache increased LUT usage by 1.27% and flip-flop usage by 3.1%, without additional BRAMs.The added cost comes from metadata and control logic.
IV. RELATED WORK
HermiCache is compared with Composable Cachelets (CC), a recent TEE-oriented cache-isolation mechanism, using configuration-aligned normalized IPC across several benchmarks.
- HermiCache is compared with Composable Cachelets, a recent TEE-oriented cache-isolation mechanism based on fine-grained cache-capacity allocation.
- HermiCache is competitive with the best and worst Composable Cachelets configurations in IPC rate.
- Figure 3 reports configuration-aligned normalized Instructions Per Cycle comparisons across several benchmarks.
V. CONCLUSION
The conclusion presents HermiCache as a cache-protection mechanism for TEEs with low area and IPC overheads. It identifies broader attack coverage, scalability analysis, and additional benchmarks as future work.
- HermiCache is a cache-protection mechanism for Trusted Execution Environments.
- The authors report low area and IPC overheads for HermiCache.
- Future work will examine broader attack coverage, scalability, and more benchmarks across several workloads.