CRII: SaTC: Secure Branch Predictors for High Performance Processors

分支预测器（BP）是当今处理器中关键的性能改进机制之一。最近的研究表明，它可以用来发起强大的攻击，如侧通道和投机性的基于执行的攻击。这些攻击使对手能够窃取敏感数据并危及计算机系统。该项目调查现有BP设计引入的安全威胁，并开发新的安全设计，以阻止BP相关的攻击，而不会显着降低性能。首先，该项目通过共享BP数据结构解决了敏感数据泄漏的问题。它开发了一种安全共享机制，允许BP结构共享，同时防止危险的碰撞。其次，该项目解决了由错误预测的分支指令引起的推测性执行威胁。这是通过重新设计处理器的推测性执行组件来实现的，通过增加对推测性指令执行的限制和缓存关键数据来防止严重的性能损失。第三，该项目开发了一种新的评估框架，用于评估和比较新的和现有的分支预测器设计的安全性和性能属性。硬件安全漏洞影响着全球数十亿台计算机。本计画旨在透过设计安全的分支预测器，来提升电脑硬体的安全性，并禁止已知及未来的攻击。因此，未来计算机的安全性将得到提高，对社会产生积极影响。该项目的发现用于课程开发。该项目积极吸引研究生参与研究。该项目生成的数据、代码和其他研究工件将存储在William和玛丽的本地机器上，并备份到内部网络存储系统。工具和数据样本将在项目网站http://www.cs.wm.edu/~dmitry/safebp/上提供。该奖项反映了NSF的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Branch predictor (BP) is one of the key performance improvement mechanisms in today's processors. Recent studies demonstrate that it can be used to initiate powerful attacks such as side-channel and speculative execution-based attacks. These attacks allow adversaries to steal sensitive data and compromise computer systems. This project investigates security threats introduced by existing BP designs and develops new safe designs to stop BP-related attacks without significantly degrading the performance. First, the project addresses the problem of sensitive data leakage through shared BP data structures. It develops a safe sharing mechanism which permits BP structure sharing while simultaneously preventing dangerous collisions. Second, the project addresses the speculative execution threats caused by incorrectly predicted branch instructions. This is achieved by redesigning speculative execution components of the processor by adding restrictions on speculative instruction execution and caching critical data to prevent drastic performance losses. Third, the project develops a novel evaluation framework that is used to evaluate and compare security and performance properties of new and existing branch predictor designs. Hardware security vulnerabilities affect billions of computers worldwide. This project intends to improve the security of computer hardware and disallow both known and future attacks by designing safe branch predictors. As a result, security of future computers will be improved, making a positive impact on society. Discoveries from this project are used in curriculum development. The project actively involves graduate students into research. Data, code and other research artifacts generated by this project will be stored locally at William and Mary machines and backed up to an in-house network storage system. Tools and data samples will be available at the project website: http://www.cs.wm.edu/~dmitry/safebp/. All data generated during this project will be kept for the duration of the project and at least two additional years.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.