# US 11,121,853 B2 · Techniques for preventing memory timing attacks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,121,853 B2
- Document ID: US11121853B2
- Status: Granted
- Kind: B2
- Application number: 16/173,041
- Filed: 2018-10-29
- Published: 2019-05-02
- Granted: 2021-09-14
- Earliest claimed: 2017-09-26
- Assignees: Intel Corporation
- Applicants: Intel Corporation
- Inventors: Nagaraju N. Kodalapura; Arun Kanuparthi
- Web page: https://patentgrep.com/patent/US11121853B2

## CPC

- H04L 9/005: {for timing attacks}
- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 21/564: {by virus signature recognition}
- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F 21/552: {involving long-term monitoring or reporting}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Techniques and apparatuses for detecting and preventing memory attacks are described. In one embodiment, for example, an apparatus may include at least one memory comprising a shared memory and a system memory, logic, at least a portion of the logic comprised in hardware coupled to the at least one shared memory, the logic to implement a memory monitor to determine a memory attack by an attacker application against a victim application using the shared memory, and prevent the memory attack, the memory monitor to determine that victim data is being reloaded into the shared memory from the system memory, store the victim data in a monitor memory, flush shared memory data stored in the shared memory, and write the victim data to the shared memory. Other embodiments are described and claimed.

## Claims

### Claim 1

An apparatus, comprising:
a processor; and
a memory comprising instructions that when executed by the processor cause the processor to:
identify an attempt to reload data into a shared memory from a system memory;
store the data in a monitor memory;
flush the shared memory; and
write the data from the monitor memory to the shared memory.

### Claim 2 (depends on 1)

The apparatus of claim 1, the memory comprising instructions that when executed by the processor cause the processor to determine a memory attack associated with the attempt to reload data into the shared memory from the system memory.

### Claim 3 (depends on 2)

The apparatus of claim 2, the memory comprising instructions that when executed by the processor cause the processor to determine the memory attack based on a data eviction event.

### Claim 4 (depends on 3)

The apparatus of claim 3, the data eviction event comprising an eviction of all or substantially all data in the shared memory.

### Claim 5 (depends on 3)

The apparatus of claim 3, the data eviction event comprising a flush memory instruction for the shared memory.

### Claim 6 (depends on 2)

The apparatus of claim 2, the memory comprising instructions that when executed by the processor cause the processor to determine the memory attack based on a memory fill event.

### Claim 7 (depends on 6)

The apparatus of claim 6, the memory fill event comprising all or substantially all of the shared memory filled with data from a single application.

### Claim 8 (depends on 1)

The apparatus of claim 1, the shared memory comprising a last level cache (LLC).

### Claim 9 (depends on 1)

The apparatus of claim 1, the processor comprising first and second cores communicatively coupled to the shared memory, wherein the attempt to reload data into the shared memory from the system memory is associated with an attacker application executed by the first core and the data is associated with a victim application executed by the second core.

### Claim 10

At least one non-transitory computer-readable medium comprising a set of instructions that, in response to being executed by a processor circuit, cause the processor circuit to:
identify an attempt to reload data into a shared memory from a system memory;
store the data in a monitor memory;
flush the shared memory; and
write the data from the monitor memory to the shared memory.

### Claim 11 (depends on 10)

The at least one non-transitory computer-readable medium of claim 10, comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to determine a memory attack associated with the attempt to reload data into the shared memory from the system memory.

### Claim 12 (depends on 11)

The at least one non-transitory computer-readable medium of claim 11, comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to determine the memory attack based on a data eviction event.

### Claim 13 (depends on 12)

The at least one non-transitory computer-readable medium of claim 12, the data eviction event comprising an eviction of all or substantially all data in the shared memory.

### Claim 14 (depends on 12)

The at least one non-transitory computer-readable medium of claim 12, the data eviction event comprising a flush memory instruction for the shared memory.

### Claim 15 (depends on 11)

The at least one non-transitory computer-readable medium of claim 11, comprising instructions that, in response to being executed by the processor circuit, cause the processor circuit to determine the memory attack based on a memory fill event.

### Claim 16 (depends on 15)

The at least one non-transitory computer-readable medium of claim 15, the memory fill event comprising all or substantially all of the shared memory filled with data from a single application.

### Claim 17 (depends on 10)

The at least one non-transitory computer-readable medium of claim 10, the shared memory comprising a last level cache (LLC).

### Claim 18

A computer-implemented method, comprising:
identifying an attempt to reload data into a shared memory from a system memory;
storing the data in a monitor memory;
flushing the shared memory; and
writing the data from the monitor memory to the shared memory.

### Claim 19 (depends on 18)

The computer-implemented method of claim 18, comprising determining a memory attack associated with the attempt to reload data into the shared memory from the system memory.

### Claim 20 (depends on 19)

The computer-implemented method of claim 19, comprising determining the memory attack based on a data eviction event.

### Claim 21 (depends on 20)

The computer-implemented method of claim 20, the data eviction event comprising an eviction of all or substantially all data in the shared memory.

### Claim 22 (depends on 20)

The computer-implemented method of claim 20, the data eviction event comprising a flush memory instruction for the shared memory.

### Claim 23 (depends on 19)

The computer-implemented method of claim 19, comprising determining the memory attack based on a memory fill event.

### Claim 24 (depends on 23)

The computer-implemented method of claim 23, the memory fill event comprising all or substantially all of the shared memory filled with data from a single application.

### Claim 25 (depends on 18)

The computer-implemented method of claim 18, the shared memory comprising a last level cache (LLC).