STBPU: A Reasonably Secure Branch Prediction Unit
STBPU: A Reasonably Secure Branch Prediction Unit
复制标题
DOI：
10.1109/dsn53405.2022.00023
复制
发表时间：
2021-08
期刊：
影响因子：
--
通讯作者：
Zhang Tao;Timothy Lesch;Kenneth Koltermann;Dmitry Evtyushkin
中科院分区：
文献类型：
--
作者：
Zhang Tao;Timothy Lesch;Kenneth Koltermann;Dmitry Evtyushkin
利用分支预测单元(BPU)内部的分支指令冲突，现代处理器遭受了大量威胁，从窃听与秘密相关的分支操作到触发恶意推测执行。从安全和性能的角度来看，保护分支机构预测者往往都是一项挑战。例如，分区或刷新BPU可以阻止某些基于冲突的利用，但范围有限。同时，这样的缓解会对分支预测精度和进一步的CPU性能产生负面影响。本文提出了一种安全的令牌分支预测单元(STBPU)，它可以在最小的性能开销下抵御基于冲突的瞬时执行攻击和BPU侧通道。STBPU通过在BPU中为每个需要隔离的软件实体定制数据表示来解决上述挑战。此外，为了防止攻击者使用暴力技术触发恶意分支指令冲突，STBPU主动监控与预测相关的事件，并抢先更改BPU数据表示。
Modern processors have suffered a deluge of threats exploiting branch instruction collisions inside the branch prediction unit (BPU), from eavesdropping on secret-related branch operations to triggering malicious speculative executions. Protecting branch predictors tends to be challenging from both security and performance perspectives. For example, partitioning or flushing BPU can stop certain collision-based exploits but only to a limited extent. Meanwhile, such mitigations negatively affect branch prediction accuracy and further CPU performance. This paper proposes Secret Token Branch Prediction Unit (STBPU), a secure BPU design to defend against collision-based transient execution attacks and BPU side channels while incurring minimal performance overhead. STBPU resolves the challenges above by customizing data representation inside BPU for each software entity requiring isolation. In addition, to prevent an attacker from using brute force techniques to trigger malicious branch instruction collisions, STBPU actively monitors the prediction-related events and preemptively changes BPU data representation.