  Caches have been used to construct various types of covert and side channels
to leak information. Most of the previous cache channels exploit the timing
difference between cache hits and cache misses. However, we introduce a new and
broader classification of cache covert channel attacks: Hit+Miss, Hit+Hit,
Miss+Miss. We highlight that cache misses (or cache hits) in different states
may have more significant time differences, which can be used as timing
channels. Based on the classification, We propose a new type of stable and
stealthy Miss+Miss cache channel.
  The write-back caches are widely deployed in modern processors. This paper
presents in detail how to use replacement latency difference to construct
timing-based channels (calles WB channel) to leak information in the write-back
cache: any modification to a cache line by a sender will set the cache line to
the dirty state, and the receiver can observe this through measuring the
latency to replace this cache set. We also demonstrate how senders could
exploit a different number of dirty cache lines in a cache set to improve
transmission bandwidth with symbols encoding multiple bits. The peak
transmission bandwidths of the WB channels in commercial systems can vary
between 1300 to 4400 Kbps per cache set in the hyper-threaded setting without
shared memory between the sender and the receiver. Different from most existing
cache channels that always target specific memory addresses, the new WB
channels focus on the cache set and cache line states, making the channel hard
to be disturbed by other processes on the core and can still work in the cache
using a random replacement policy. We also analyzed the stealthiness of WB
channels from the perspective of the number of cache loads and cache miss
rates. Further, This paper discusses and evaluates possible defenses. The paper
finishes by discussing various forms of side-channel attacks.
