SpecBox: A Label-Based Transparent Speculation Scheme Against Transient Execution Attacks
SpecBox: A Label-Based Transparent Speculation Scheme Against Transient Execution Attacks
复制标题
SPECBOX：针对瞬态执行攻击的基于标签的透明推测方案
DOI：
10.1109/tdsc.2022.3144287
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Guoqing Harry Xu
中科院分区：
文献类型：
--
作者：
Bowen Tang;Chenggang Wu;Zhe Wang;Lichen Jia;Pen-Chung Yew;Yueqiang Cheng;Yinqian Zhang;Chenxi Wang;Guoqing Harry Xu
推测执行技术已经成为现代处理器提高并行性的基石。然而，最近的研究表明，这种技术可以被攻击者利用，通过瞬态执行攻击（如Spectre）泄漏秘密数据。针对这一问题提出了许多防御措施，但它们都面临着各种挑战：（1）跟踪指令流水线中的数据流可以全面解决这一问题，但它可能会导致流水线停顿并产生高性能开销;（2）使攻击者无法感知推测执行的副作用，但它通常需要额外的存储组件和复杂的数据移动操作。在这篇文章中，我们提出了一个基于标签的透明投机计划称为SpecBox。它动态地划分该高速缓存系统以隔离推测数据和非推测数据，这可以防止瞬态执行被后续执行观察到。此外，它使用线程所有权信号量来防止跨核访问推测性数据。此外，SpecBox还增强了该高速缓存系统中的辅助组件，如硬件预取器，以抵御瞬时执行攻击。安全性分析表明SpecBox是安全的，性能评估表明SpecBox在SPEC CPU 2006和PARSEC-3.0基准测试中的性能开销很小。
Speculative execution techniques have been a cornerstone of modern processors to improve instruction-level parallelism. However, recent studies showed that this kind of techniques could be exploited by attackers to leak secret data via transient execution attacks, such as Spectre. Many defenses are proposed to address this problem, but they all face various challenges: (1) Tracking data flow in the instruction pipeline could comprehensively address this problem, but it could cause pipeline stalls and incur high performance overhead; (2) Making side effect of speculative execution imperceptible to attackers, but it often needs additional storage components and complicated data movement operations. In this article, we propose a label-based transparent speculation scheme called SpecBox. It dynamically partitions the cache system to isolate speculative data and non-speculative data, which can prevent transient execution from being observed by subsequent execution. Moreover, it uses thread ownership semaphores to prevent speculative data from being accessed across cores. In addition, SpecBoxalso enhances the auxiliary components in the cache system against transient execution attacks, such as hardware prefetcher. Our security analysis shows that SpecBoxis secure and the performance evaluation shows that the performance overhead on SPEC CPU 2006 and PARSEC-3.0 benchmarks is small.