Channel protection method and device for processor branch prediction

Abstract

The invention discloses a branch prediction attack prevention method and device, a chip and a medium. The method comprises the steps of determining a program category of a program to which a target branch instruction belongs; if the program category is a security trusted program, determining the configuration condition of a branch predictor; when it is determined that a first preset branch predictor and a second preset branch predictor exist according to the configuration condition of the branch predictors, predicting the target branch instruction by using the second preset branch predictor; when determining that a first preset branch predictor exists according to the configuration condition of the branch predictor, determining that the first preset branch predictor predicts an enabling state of a target branch instruction, and processing the target branch instruction according to the enabling state; wherein the first preset branch predictor is used for predicting a branch instruction of the unsecure trusted program. By adopting the method, the risk of branch prediction can be reduced on hardware and software, the safety of branch prediction is ensured, and the probability of sensitive information leakage is reduced.

Description

Technical Field

[0001] The present invention relates to the field of microprocessor security technology, and in particular to a channel protection method and device for processor branch prediction. Background Art

[0002] Branch instructions are important control flow instructions in the processor instruction set architecture. In order to speed up the execution of branch instructions, a branch predictor is added in the processor instruction fetch stage, that is, the instruction fetch location. The branch predictor can accurately predict the execution result of the branch instruction, so that when fetching instructions, it can correctly determine the address of the next instruction of the branch instruction, and then fetch the instruction with the correct address in advance and send it to the next stage pipeline for execution.

[0003] The branch predictor is trained based on the execution results of previous branch instructions. For example, if a branch instruction has been a jump for the previous n times, then the branch predictor will give a jump prediction result when it encounters the current branch instruction for the n+1th time.

[0004] The emergence of branch predictors has made the execution of branch instructions faster and improved the execution efficiency of the processor. However, there are attackers who use branch prediction to carry out attacks. Attackers can train branch predictors by forcing the execution of branches that tend to hit (or miss) a certain address. When another victim process runs, it will predict that the branch at the trained address will hit (or miss). The hit or miss time can be measured to form a covert channel, thereby leaking sensitive information, so that attackers can use this covert channel to steal data or perform other malicious operations. Summary of the invention

[0005] Based on this, it is necessary to provide a channel protection method and device for processor branch prediction that can improve the security of branch prediction and protect data privacy in response to the above technical problems.

[0006] A channel protection method for processor branch prediction, comprising:

[0007] determining a program category of a program to which a target branch instruction belongs;

[0008] If the program category is a secure trusted program, determining a configuration of a branch predictor;

[0009] When it is determined according to the configuration of the branch predictor that there is a first preset branch predictor and a second preset branch predictor, using the second preset branch predictor to predict the target branch instruction;

[0010] When it is determined that there is a first preset branch predictor according to the configuration of the branch predictor, the enable state of the target branch instruction predicted by the first preset branch predictor is determined, and the target branch instruction is processed according to the enable state; wherein the first preset branch predictor is used to predict branch instructions of non-secure trusted programs.

[0011] A channel protection device for processor branch prediction, comprising:

[0012] A first determination module, used to determine the program category of the program to which the target branch instruction belongs;

[0013] A second determination module, configured to determine a configuration of a branch predictor if the program category is a security trusted program;

[0014] A prediction module, when it is determined according to the configuration of the branch predictor that there are a first preset branch predictor and a second preset branch predictor, uses the second preset branch predictor to predict the target branch instruction; when it is determined according to the configuration of the branch predictor that there is a first preset branch predictor, determines the enable state of the first preset branch predictor predicting the target branch instruction, and processes the target branch instruction according to the enable state; wherein the first preset branch predictor is used to predict branch instructions of non-secure trusted programs.

[0015] A chip includes a memory and a processor. The memory stores a computer program. When the processor executes the computer program, the steps of the channel protection method of the branch prediction of the sub-processor are implemented.

[0016] A computer-readable storage medium stores a computer program, which implements the steps of the channel protection method of the processor branch prediction when the computer program is executed by a processor.

[0017] The channel protection method and device for processor branch prediction described above determine the program category of the program to which the target branch instruction belongs. If the program category is a secure trusted program, the configuration of the branch predictor is determined. When two branch predictors are configured, different branch predictors are provided for branch instructions of different program categories, which can eliminate the influence of the branch prediction training results of the attacker's program on the branch prediction results of the security-sensitive program from the hardware resources, thereby protecting the sensitive information of the security-sensitive program. When one branch predictor is configured, the enable state of the branch predictor predicting the target branch instruction is determined, and the target branch instruction is processed according to the enable state, thereby limiting the risk of sensitive information leakage to a certain extent by dynamically adjusting the processing of the target branch instruction by the branch predictor, thereby ensuring the security of branch prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A schematic flow chart of a channel protection method for processor branch prediction in one embodiment;

[0019] Figure 2 A block diagram of a pipeline process in which two branch predictors are introduced in one embodiment;

[0020] Figure 3 A block diagram of a pipeline process for introducing sensitive branch instructions in one embodiment;

[0021] Figure 4 A block diagram of a pipeline process for introducing pseudo-random numbers in one embodiment;

[0022] Figure 5 A structural block diagram of a channel protection device for processor branch prediction in one embodiment. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0024] The implementation details of the technical solution of the embodiment of the present application are described in detail below.

[0025] In one embodiment, Figure 1 As shown, a channel protection method for processor branch prediction is provided, and the channel protection method for processor branch prediction may include the following steps:

[0026] Step S101, determining the program type of the program to which the target branch instruction belongs.

[0027] A branch instruction is an instruction in a computer program. The branch instruction is used in a program to implement the program's logical control flow and process control, so that the program can select different execution paths according to different conditions, thereby realizing complex logical operations and control processes.

[0028] The branch predictor is used to predict the execution path of branch instructions to improve the efficiency of program execution. By predicting the execution path of branch instructions, the processor can continue to execute instructions on the predicted path, thereby avoiding pipeline pauses caused by waiting for branch instructions and improving the execution speed of instructions. However, branch predictors may also have security risks, such as side channel attacks. When an attacker executes an attack program, the operation of the branch predictor will be triggered during the execution of the attack program. By learning the behavior of the branch predictor, the attack program can use the execution path of the program to leak sensitive information. Based on this, a security check is performed before branch prediction, so that a preliminary analysis can be made as to whether the branch predictor may be attacked.

[0029] The security check here is mainly to determine the program category of the program to which the target branch instruction belongs. Among them, the program category can be divided into secure trusted programs and non-secure trusted programs, which have different security requirements and characteristics. Secure trusted programs refer to programs that are considered trustworthy and have high security requirements. These programs usually include programs that process sensitive data, perform critical tasks, or need to protect user privacy. Non-secure trusted applications refer to general applications, including attack programs, which may not have such high security requirements, or may have a certain degree of security risks, and are usually not granted permission to access sensitive data or perform critical tasks.

[0030] Therefore, compared with non-secure trusted programs, secure trusted programs require a more secure branch prediction environment and need to reduce the probability of the branch predictor of the secure trusted program being attacked, so as to better protect the sensitive information of the secure trusted program.

[0031] Step S102: if the program type is a security trusted program, then determine the configuration of the branch predictor.

[0032] Here, the secure trusted program can be a program that executes encryption and decryption algorithms, which usually involve processing sensitive information, such as encryption passwords, decryption data, and other operations. Based on this, when the program to which the target branch instruction belongs runs the encryption and decryption algorithm, the current program can be identified as a secure trusted program through the relevant registers. Of course, in actual applications, the category of the program to which the target branch instruction belongs can also be comprehensively judged based on information such as the source and reputation of the program, the permissions and access control of the program, and other information.

[0033] In practical applications, branch predictors are usually attacked when running non-secure trusted programs. Therefore, in order to avoid attacks on the branch predictor that predicts the secure trusted program, the branch prediction of the non-secure trusted program can be isolated from the branch prediction of the secure trusted program through hardware. That is, there is a branch predictor dedicated to predicting the secure trusted program and a branch predictor dedicated to predicting the non-secure trusted program, so that the branch predictor dedicated to predicting the secure trusted program will not be attacked by the attacking program.

[0034] It is understandable that the branch predictions of different program categories can only be isolated with the support of corresponding hardware configuration. Therefore, if it is determined that the program category of the program to which the target branch belongs is a safe program, then it is necessary to further determine the configuration of the branch predictor, where the configuration here mainly refers to the number of branch predictors configured by the processor.

[0035] Step S103: when it is determined according to the configuration of the branch predictor that there is a first preset branch predictor and a second preset branch predictor, the target branch instruction is predicted using the second preset branch predictor.

[0036] In one configuration, the processor is respectively configured with a first preset branch predictor and a second preset branch predictor, and the two branch predictors are independent of each other and do not affect each other. The first preset branch predictor and the second preset branch predictor are configured to process branch instructions of different program categories, wherein the first preset branch predictor is configured to process branch instructions of non-secure trusted programs, and the second preset branch predictor is configured to process branch instructions of secure trusted programs, so that the branch instructions of secure trusted programs and non-secure trusted programs will be handled by two independent branch predictors respectively, reducing the cross-influence and interference between them, making it difficult for attackers to conduct side channel attacks on the second preset branch predictor, ensuring that the second preset branch predictor can work normally, thereby ensuring the normal operation and security of the system.

[0037] When it is determined that there are a first preset branch predictor and a second preset branch predictor according to the configuration of the branch predictor, branch predictions of different program categories can be isolated on hardware, and the second preset branch predictor predicts the target branch instruction of the security trusted program.

[0038] Among them, the branch instructions of the non-secure trusted program are predicted by the first preset branch predictor, and the untrusted attacker program will run on the first preset branch predictor. The untrusted attacker program cannot affect the prediction result of the second preset branch predictor by training the first preset branch predictor, which makes the prediction result of the second preset branch predictor unpredictable, and the attacker program cannot judge the running result of a sensitive branch of the secure trusted program by the length of running time. At the same time, the query and update of the branch predictor only involves the selected branch predictor, and will not affect the unselected branch predictor, so as to ensure the security of branch prediction.

[0039] In practical applications, when a first preset branch predictor and a second preset branch predictor are configured, a control status register is customized, and the control status register is used to select the branch predictor currently in use, and the branch predictor for branch prediction of the target branch instruction is determined in the first preset branch predictor and the second preset branch predictor according to the configuration information of the first control status register. For example, when scheduling a time slice, the operating system selects the first preset branch predictor or the second preset branch predictor according to the program category to which the current target branch instruction belongs, and then configures the first control status register. When the lowest bit of the first control status register is 1, it indicates that the current target branch instruction uses the first preset branch predictor; when the lowest bit of the first control status register is 0, it indicates that the current target branch instruction uses the second preset branch predictor, so that the configuration information of the control status register can be used to determine the branch predictor for processing the target branch instruction.

[0040] like Figure 2 As shown, Figure 2 The block diagram of the pipeline processing with two branch predictors is shown. The pipeline can be divided into the following different stages: instruction fetch stage, decoding stage, execution stage and write-back stage. The processing of the target branch instruction in each stage is described in detail below.

[0041] Instruction fetch stage:

[0042] The instruction fetch stage is divided into two sub-stages, namely instruction fetch stage 1 and instruction fetch stage 2. In these two sub-stages, instructions are extracted and branch prediction is performed on the extracted instructions using the branch predictor. The first preset branch predictor and the second preset branch predictor are included. For the target branch instruction of the secure trusted program, the second preset branch predictor is used for prediction; for the target branch instruction of the non-secure trusted program, the first preset branch predictor is used for prediction. Subsequent processing is then performed based on the prediction results.

[0043] Among them, in the instruction fetch stage, the program counter is used to record the location of the instruction currently being executed by the processor, and the instruction cache is used to store the area for pre-fetched instructions to speed up the process of the processor accessing instructions. The input signals of the program counter and the instruction cache are derived from the branch prediction results, the results of the execution unit, and the instruction sequence information, thereby determining the instructions that need to be fetched.

[0044] Decode stage: In the decode stage, the processor identifies and decodes the target branch instruction to determine that it is a branch instruction. This includes identifying the opcode of the target branch instruction and the associated operands.

[0045] Execution phase:

[0046] (1) Execute the target branch instruction and calculate the correct address corresponding to the target branch instruction, where the correct address here refers to the real branch target address calculated based on the jump condition of the branch instruction.

[0047] (2) Compare the execution result of the branch instruction with the prediction result of the branch predictor.

[0048] (3) If the prediction result is correct, that is, the execution result is consistent with the prediction result, the subsequent instructions will continue to be executed, and the pipeline does not need to make any adjustments. It can be understood that when the prediction is correct, the instructions that have been loaded and ready in the pipeline are the instructions that need to be executed. They are in the correct control flow path, so there is no need to reload the instructions, and the subsequent instructions can be directly executed in the pipeline.

[0049] (4) If the prediction result is wrong, that is, the correct address is inconsistent with the predicted result, the pipeline needs to be refreshed, the instruction is re-fetched from the correct address and loaded into the pipeline, and the correct address is fed back to the branch predictor to update its prediction model.

[0050] Write-back phase:

[0051] (1) Execute branch instruction: The target branch instruction has been executed in the previous stage (such as the execution stage) and the branch result is obtained. In the write-back stage, the execution result of the target branch instruction is written back to the register file or memory (if necessary) so that the subsequent instructions can use this result.

[0052] (2) Update register file: If the target branch instruction has a result that needs to be written back, the write-back phase will update the corresponding register value in the register file so that other instructions can read the execution result of the target branch instruction.

[0053] (3) Clear the target branch instruction in the pipeline: The write-back stage may clear the target branch instruction in the pipeline so that subsequent instructions can continue to execute. This ensures the normal operation of the pipeline and does not cause problems due to the influence of branch instructions.

[0054] Step S104, when it is determined according to the configuration of the branch predictor that there is a first preset branch predictor, determining an enable state of the first preset branch predictor predicting the target branch instruction, and processing the target branch instruction according to the enable state.

[0055] In another configuration, in order to reduce hardware cost and resource occupation, the processor is configured with only one branch predictor (first branch predictor) for branch prediction of security trusted programs and branch prediction of non-security trusted programs.

[0056] It should be noted that for branch instructions of non-secure trusted programs, the first preset branch predictor will be used for processing. Therefore, there is a probability that the first preset branch predictor will be attacked, so that when the first preset branch predictor is directly used to process the target branch instructions of the secure trusted program, there is a risk of sensitive information leakage.

[0057] Based on this, when it is determined that there is a first preset branch predictor according to the configuration of the branch predictor, the enable state of the first preset branch predictor predicting the target branch instruction is further determined. The enable state here refers to whether the first preset branch predictor is allowed to process the target branch instruction. By dynamically adjusting the processing of the target branch instruction of the security trusted program by the first preset branch predictor, the risk of sensitive information leakage can be prevented.

[0058] Then, the target branch instruction is processed accordingly according to the enable state of the target branch instruction predicted by the first preset branch predictor.

[0059] In actual applications, the enable state can be to prohibit the first preset branch predictor from processing the target branch instruction, or to use the first preset branch predictor to process the target branch instruction in a limited manner. For example, according to the security level of the target branch instruction, the first preset branch predictor is used in a limited manner for processing, or, after the target branch instruction is processed by the first preset branch predictor, corresponding processing measures are taken. These processing measures can limit the attack program from learning the behavior of the first preset branch predictor, thereby reducing the probability of the first preset branch predictor being attacked even when the first preset branch predictor is used to perform branch prediction processing for secure trusted programs and non-secure trusted programs, thereby protecting sensitive information.

[0060] In one embodiment, it is determined that the first preset branch predictor is prohibited from predicting the target branch instruction, and when the execution stage of the pipeline completes executing the target branch instruction, the pipeline is refreshed and instructions are re-fetched from the correct address of the subsequent branch instruction of the target branch instruction.

[0061] Here, it is determined that the first preset branch predictor is prohibited from predicting the target branch instruction, that is, the branch prediction of the target branch instruction of the security trusted program is not performed in the instruction fetch stage, but after reading the target branch instruction, the subsequent decoding stage, execution stage and write-back stage are entered. Specifically, the execution stage of the pipeline executes the target branch instruction, and during the execution process, the branch condition of the target branch instruction is judged to determine whether the branch should be executed, so that according to the judgment result of the branch condition, the processor decides whether a jump is required, and finally determines the correct address corresponding to the branch instruction.

[0062] When the target branch instruction is executed at the execution stage of the pipeline, that is, the correct address of the target branch instruction is determined, the pipeline needs to be refreshed and the correct address of the subsequent branch instruction of the target branch instruction is re-obtained to ensure the correctness of program execution.

[0063] If the pipeline is not refreshed without branch prediction, subsequent instructions may be executed out of order under the uncertain path of the branch instruction, destroying the order of instructions and affecting the correct execution of the program. By refreshing the pipeline, the pipeline can be restored to the correct state, clearing the unexecuted instructions in the pipeline, restarting the instruction fetch stage, and ensuring the correct execution of subsequent instructions.

[0064] It should be noted that in this embodiment, the pipeline needs to be refreshed regardless of whether the execution level determines whether it is a jump. This is different from the pipeline refresh in static prediction (i.e., when encountering a branch, it is generally defaulted not to jump. During execution, if it is determined not to jump, then the pipeline does not need to be refreshed. If it jumps, the pipeline is refreshed and the instruction is re-fetched), so that the time side channel problem caused by branch instructions can be solved. This is because the existence of branch instructions will cause execution time differences between different branch paths, which may leak sensitive information about program execution. By refreshing the pipeline, the time difference caused by branch instructions can be eliminated, reducing the risk of time side channel leakage.

[0065] In one embodiment, it is determined whether the target branch instruction is a sensitive branch instruction; if so, it is determined that the first preset branch predictor is prohibited from predicting the target branch instruction, and when the execution stage of the pipeline completes executing the target branch instruction, the pipeline is refreshed and the instruction is re-fetched from the correct address of the subsequent branch instruction of the target branch instruction.

[0066] Security trusted programs may contain sensitive branch instructions, which often involve important information such as security keys and user credentials. Therefore, it is necessary to effectively avoid making riskier branch predictions when executing sensitive branch instructions, so as to better protect data privacy and security. Non-sensitive branch instructions usually do not involve any confidential data or critical information, so branch predictions for non-sensitive branch instructions have lower risks.

[0067] Based on this, when the processor is only configured with the first preset branch predictor and the target branch instruction belongs to a secure trusted program, it is necessary to determine whether the target branch instruction is a sensitive branch instruction. In practical applications, a sensitive branch instruction may refer to a branch instruction of a sensitive address (a certain address or address segment), so that whether the target branch instruction is a sensitive branch instruction can be determined by the address of the target branch instruction.

[0068] When it is determined that the target branch instruction is a sensitive branch instruction, branch prediction for the target branch instruction is prohibited, that is, in the instruction fetching stage, the target branch instruction will not be input into the first preset branch predictor, but will enter the subsequent decoding stage, execution stage and write-back stage. In this embodiment, by disabling branch prediction for sensitive branch instructions, some sensitive codes are not affected by the branch predictor, which can reduce the risk of temporal side channel attacks and prevent attackers from using the state of the branch predictor to infer sensitive information.

[0069] In the execution stage, the execution stage of the pipeline will execute the target branch instruction. Specifically, the execution stage of the pipeline judges the branch condition of the target branch instruction to determine whether the branch should be executed. Based on the judgment result of the branch condition, the processor decides whether a jump is required and finally determines the correct address corresponding to the branch instruction.

[0070] After the correct address is determined, the pipeline will be refreshed unconditionally, and the instruction will be re-fetched from the correct address of the subsequent branch instruction of the target branch instruction to carry out normal processing of the subsequent instructions. In practical applications, refreshing the pipeline and re-fetching values ​​from the correct address can be achieved by sending a flush signal from the execution level to the front-end pipeline level (fetch and decode level, etc.). The flush signal is used in processor design to clear or invalidate the instructions in the pipeline, and the process of re-fetching instructions in the pipeline by discarding the instructions that have been taken out but not yet executed. The flush signal is generally used to handle branch prediction errors or other abnormal situations. In this embodiment, it is set to send a flush signal no matter what the situation is when the execution of the target branch instruction is completed, so as to ensure that the pipeline is cleared after the sensitive branch instruction is executed, avoid any potential information leakage, reduce the possibility of attackers using time side channel attacks and other attack methods, and ensure the consistency of the processor state.

[0071] In one embodiment, if the target branch instruction is not a sensitive branch instruction, a first preset branch predictor is used to predict the target branch instruction.

[0072] When it is determined that the target branch instruction is not a sensitive branch instruction, the target branch instruction can be predicted normally, wherein the first preset branch predictor is used to predict the target branch instruction and obtain the corresponding prediction result. In the execution stage, the execution level will calculate the correct address corresponding to the target branch instruction. If the correct address is inconsistent with the prediction result, the pipeline will be refreshed and the instruction will be re-fetched from the correct address. It should be noted that the pipeline refresh here is triggered when the correct address is inconsistent with the prediction result, and when the target branch instruction is a sensitive branch instruction, the pipeline refresh will be performed in any case.

[0073] like Figure 3 As shown, Figure 3 The block diagram of the pipeline processing of introducing sensitive branch instructions is shown. In the instruction fetch stage, a first preset branch predictor is included, and the branch predictor is configured to not perform branch prediction for the secure and trusted sensitive branch instructions, and perform branch prediction for other branch instructions. In addition, the instruction fetch stage, the decoding stage and the write-back stage can refer to Figure 2 In the execution phase, the judgment result about the target branch instruction is determined. This judgment result can determine whether the target branch instruction is a sensitive branch instruction, and if the target branch instruction is a sensitive branch instruction, a flush signal is sent to the front end of the pipeline.

[0074] It should be noted that the judgment of the target branch instruction is performed at the latest in the execution stage, that is, the judgment of the target branch instruction can be performed in the instruction fetch stage, the encoding stage and the execution stage. If it is performed in the instruction fetch stage or the encoding stage, the judgment result will be passed to the execution stage, so that the execution stage can refresh the pipeline according to the judgment result.

[0075] In one embodiment, address information of sensitive branch instructions configured by multiple setting control status registers is used to determine whether a target branch instruction is a sensitive branch instruction.

[0076] A custom setting control status register is configured with the address information of the sensitive branch instruction. The configuration information of the setting control status register can be used to determine whether the target branch instruction is a sensitive branch instruction. Specifically, in the instruction fetching stage, the system can read the configuration information in the register and check whether the address of the target branch instruction is within the address range of the prohibited branch prediction, thereby determining whether the target branch instruction is a sensitive branch instruction. The address of the target branch instruction can be determined from the program counter.

[0077] It should be noted that the properties of the control status register are set to be readable and writable in high-privilege mode and read-only but not writable in low-privilege mode. It can be changed by the operating system running in high-privilege mode, and ordinary user programs running in low-privilege mode have no right to modify it.

[0078] In one embodiment, a target branch instruction is predicted using a first preset branch predictor; when the target branch instruction is predicted correctly, a pseudo-random number is generated, and whether to refresh the pipeline is determined based on a comparison result between the pseudo-random number and a preset threshold.

[0079] The target branch instruction is predicted by using the first preset branch predictor to obtain the prediction result of the target branch instruction, and the decoding stage, the execution stage and the write-back stage are entered to process the target branch instruction accordingly. It can be understood that since both the secure trusted program and the non-secure trusted program use the first preset branch predictor to perform branch prediction, the control flow structure of the secure trusted program is easier to predict and analyze, which increases the risk of side channel attacks and sensitive data leakage.

[0080] Based on this, in the execution stage, if it is determined that the target branch instruction is predicted correctly, that is, the prediction result is consistent with the correct address calculated by the execution stage for the target branch instruction, a pseudo-random number is generated, and whether to refresh the pipeline is determined based on the comparison result between the pseudo-random number and the preset threshold. In actual applications, pseudo-random numbers are generated when the prediction is correct, that is, when the prediction is correct in each round, a corresponding pseudo-random number is generated, and the generation of pseudo-random numbers can be achieved using a pseudo-random number generator.

[0081] Among them, the pseudo-random number and the preset threshold register have the same bit width. If the generated pseudo-random number is greater than or equal to the preset threshold, the pipeline is refreshed and the value is re-taken from the correct address determined by the execution level. If the generated pseudo-random number is less than the preset threshold, the subsequent instructions continue to be executed, so that the pipeline can be randomly refreshed when the prediction is correct, so as to reduce or eliminate the time difference between the correctness of the branch prediction. It can be understood that if the security trusted program relies entirely on the prediction results, its control flow will become easier to predict, thereby increasing the risk of side channel attacks, and the prediction model of the branch predictor itself may contain security-sensitive information, which can be obtained and exploited by attackers. Randomly refreshing the pipeline can increase uncertainty and destroy attacks that exploit the prediction results, thereby ensuring the security of branch prediction.

[0082] In one embodiment, the preset threshold is positively correlated with the security level of the secure trusted program, so that the preset threshold can be dynamically adjusted according to the security level of the secure trusted program. It can be understood that programs with higher security levels also involve greater security risks, and should be given a higher degree of randomized protection. Based on this, for secure trusted programs with higher security levels, a larger threshold should be set to provide stronger random protection. For example, for programs with high security level requirements, the preset threshold is set to 100% (the preset threshold register is all 0), and for programs with low security level requirements, the preset threshold is set to a value between 0 and 100%, such as 50% (the preset threshold register takes the middle value), and for programs without security level requirements, the preset threshold can be set to 0 (the preset threshold register is all 1). Linking the pre-threshold rate to the security level can more finely control the degree of randomization of programs of different degrees, which not only ensures security but also does not affect the prediction efficiency. Among them, the higher the preset threshold, the higher the security level that can be achieved, but the corresponding performance loss is more serious. In practical applications, the corresponding preset threshold can be set according to hardware resources, actual conditions, etc.

[0083] In practical applications, taking the RISC-V architecture as an example, the preset threshold registers corresponding to different security trusted programs can be implemented through custom control and status registers. When the prediction is correct, the pseudo-random number is compared with the value of the preset threshold register.

[0084] like Figure 4 As shown, Figure 4 A block diagram of the pipeline processing of introducing pseudo-random numbers is shown. In the instruction fetch stage, a first preset branch predictor is included, and the branch predictor can predict the target branch instructions of the non-secure trusted program and the secure trusted program. In addition, the instruction fetch stage, the decoding stage and the write-back stage can refer to Figure 2 In the fetch phase, decode phase, and write-back phase. Figure 4In the execution stage shown, a pseudo-random number is generated and a preset threshold is read. When it is determined that the branch prediction is correct, the pseudo-random number is compared with the preset threshold. When the pseudo-random number is greater than or equal to the preset threshold, a flush signal is sent to the front end of the pipeline.

[0085] In the above embodiment, the program category of the program to which the target branch instruction belongs is determined. If the program category is a secure trusted program, the configuration of the branch predictor is determined. In the case of configuring two branch predictors, different branch predictors are provided for branch instructions of different program categories, so that the secure trusted program is not affected by the branch results of other programs, and the influence of the branch prediction training results of the attacker's program on the branch prediction results of the secure trusted program can be eliminated from the hardware resources, so that the attacker cannot infer the branch execution results of the secure trusted program from the execution time of the branch, thereby protecting the sensitive information of the secure trusted program. In the case of configuring one branch predictor, the enable state of the branch predictor predicting the target branch instruction is determined, and the target branch instruction is processed according to the enable state, so that by dynamically adjusting the processing of the target branch instruction by the branch predictor, the risk of sensitive information leakage can be limited to a certain extent, thereby ensuring the security of branch prediction.

[0086] In one embodiment, a channel protection device for processor branch prediction is provided, referring to Figure 5 As shown, the channel protection device 500 for processor branch prediction may include: a first determination module 501 , a second determination module 502 and a prediction module 503 .

[0087] Among them, the first determination module 501 is used to determine the program category of the program to which the target branch instruction belongs; the second determination module 502 is used to determine the configuration of the branch predictor if the program category is a secure trusted program; the prediction module 503 is used to determine the existence of a first preset branch predictor and a second preset branch predictor according to the configuration of the branch predictor, and use the second preset branch predictor to predict the target branch instruction; when it is determined according to the configuration of the branch predictor that there is a first preset branch predictor, determine the enable state of the first preset branch predictor to predict the target branch instruction, and process the target branch instruction according to the enable state; wherein the first preset branch predictor is used to predict branch instructions of non-secure trusted programs.

[0088] In one embodiment, the prediction module 503 is specifically used to determine that the first preset branch predictor is prohibited from predicting the target branch instruction, and when the execution stage of the pipeline completes executing the target branch instruction, the pipeline is refreshed and the instruction is re-fetched from the correct address of the subsequent branch instruction of the target branch instruction.

[0089] In one embodiment, the prediction module 503 is specifically used to determine whether the target branch instruction is a sensitive branch instruction;

[0090] If so, it is determined that the first preset branch predictor is prohibited from predicting the target branch instruction, and when the execution stage of the pipeline completes executing the target branch instruction, the pipeline is refreshed and instructions are re-fetched from the correct address of the subsequent branch instruction of the target branch instruction.

[0091] In one embodiment, the prediction module 503 is specifically configured to use a first preset branch predictor to predict the target branch instruction if the target branch instruction is not a sensitive branch instruction.

[0092] In one embodiment, the prediction module 503 is specifically used to predict the target branch instruction using a first preset branch predictor;

[0093] When the target branch instruction is predicted correctly, a pseudo-random number is generated, and whether to refresh the pipeline is determined based on the comparison result between the pseudo-random number and a preset threshold.

[0094] In one embodiment, the prediction module 503 is specifically used to refresh the pipeline if the pseudo-random number is greater than or equal to a preset threshold;

[0095] If the pseudo-random number is less than the preset threshold, continue to execute subsequent instructions.

[0096] In one embodiment, the preset threshold is positively correlated with the security level of the security trusted program.

[0097] In one embodiment, the prediction module 503 is specifically used to determine whether the target branch instruction is a sensitive branch instruction by using address information of sensitive branch instructions configured by multiple setting control status registers.

[0098] For the specific definition of the processor branch prediction channel protection device 500, please refer to the definition of the processor branch prediction channel protection method above, which will not be repeated here. Each module in the above-mentioned processor branch prediction channel protection device 500 can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0099] In one embodiment, a chip is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor implements a channel protection method for processor branch prediction when executing the computer program.

[0100] In one embodiment, a computer storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, a channel protection method for processor branch prediction is implemented.

[0101] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0102] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0103] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0104] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0105] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A channel protection method for processor branch prediction, characterized in that: The method comprises: determining a program category of a program to which a target branch instruction belongs; If the program category is a secure trusted program, determining a configuration of a branch predictor; When it is determined according to the configuration of the branch predictor that there is a first preset branch predictor and a second preset branch predictor, using the second preset branch predictor to predict the target branch instruction; When it is determined that there is a first preset branch predictor according to the configuration of the branch predictor, the enable state of the target branch instruction predicted by the first preset branch predictor is determined, and the target branch instruction is processed according to the enable state; wherein the first preset branch predictor is used to predict branch instructions of non-secure trusted programs.

2. The channel protection method for processor branch prediction according to claim 1, characterized in that: The determining that the first preset branch predictor predicts an enable state of the target branch instruction, and processing the target branch instruction according to the enable state includes: It is determined that the first preset branch predictor is prohibited from predicting the target branch instruction, and when the execution stage of the pipeline completes executing the target branch instruction, the pipeline is refreshed and instructions are re-fetched from the correct address of the subsequent branch instruction of the target branch instruction.

3. The channel protection method for processor branch prediction according to claim 2, characterized in that: The determining that the first preset branch predictor predicts an enable state of the target branch instruction, and processing the target branch instruction according to the enable state includes: Determining whether the target branch instruction is a sensitive branch instruction; If so, it is determined that the first preset branch predictor is prohibited from predicting the target branch instruction, and when the execution stage of the pipeline completes executing the target branch instruction, the pipeline is refreshed and instructions are re-fetched from the correct address of the subsequent branch instruction of the target branch instruction.

4. The channel protection method for processor branch prediction according to claim 3, characterized in that: The determining that the first preset branch predictor predicts an enable state of the target branch instruction, and processing the target branch instruction according to the enable state includes: If the target branch instruction is not a sensitive branch instruction, the target branch instruction is predicted using the first preset branch predictor.

5. The channel protection method for processor branch prediction according to claim 2, characterized in that: The determining that the first preset branch predictor predicts an enable state of the target branch instruction, and processing the target branch instruction according to the enable state includes: Predicting the target branch instruction using the first preset branch predictor; When the target branch instruction is predicted correctly, a pseudo-random number is generated, and whether to refresh the pipeline is determined according to a comparison result between the pseudo-random number and a preset threshold.

6. The channel protection method for processor branch prediction according to claim 5, characterized in that: The step of determining whether to refresh the pipeline according to the comparison result between the pseudo-random number and a preset threshold value comprises: If the pseudo-random number is greater than or equal to the preset threshold, refreshing the pipeline; If the pseudo-random number is less than the preset threshold, continue to execute subsequent instructions.

7. The channel protection method for processor branch prediction according to claim 6, characterized in that: The preset threshold is positively correlated with the security level of the security trusted program.

8. The channel protection method for processor branch prediction according to claim 3, characterized in that: The determining whether the target branch instruction is a sensitive branch instruction comprises: The address information of the sensitive branch instruction configured by multiple setting control status registers is used to determine whether the target branch instruction is a sensitive branch instruction.

9. A channel protection device for processor branch prediction, characterized in that: include: A first determination module, used to determine the program category of the program to which the target branch instruction belongs; A second determination module, configured to determine a configuration of a branch predictor if the program category is a security trusted program; A prediction module, when determining that there is a first preset branch predictor and a second preset branch predictor according to the configuration of the branch predictor, predicting the target branch instruction using the second preset branch predictor; When it is determined that there is a first preset branch predictor according to the configuration of the branch predictor, the enable state of the target branch instruction predicted by the first preset branch predictor is determined, and the target branch instruction is processed according to the enable state; wherein the first preset branch predictor is used to predict branch instructions of non-secure trusted programs.

10. The channel protection device for processor branch prediction according to claim 9, characterized in that: The prediction module is specifically used to determine that the first preset branch predictor is prohibited from predicting the target branch instruction, and when the execution stage of the pipeline completes executing the target branch instruction, refresh the pipeline and re-fetch instructions from the correct address of the subsequent branch instruction of the target branch instruction.

11. The channel protection device for processor branch prediction according to claim 10, characterized in that: The prediction module is specifically used to determine whether the target branch instruction is a sensitive branch instruction; If so, it is determined that the first preset branch predictor is prohibited from predicting the target branch instruction, and when the execution stage of the pipeline completes executing the target branch instruction, the pipeline is refreshed and instructions are re-fetched from the correct address of the subsequent branch instruction of the target branch instruction.

12. The channel protection device for processor branch prediction according to claim 10, characterized in that: The prediction module is specifically configured to use the first preset branch predictor to predict the target branch instruction if the target branch instruction is not a sensitive branch instruction.

13. The channel protection device for processor branch prediction according to claim 12, characterized in that: The prediction module is specifically used to predict the target branch instruction using the first preset branch predictor; When the target branch instruction is predicted correctly, a pseudo-random number is generated, and whether to refresh the pipeline is determined according to a comparison result between the pseudo-random number and a preset threshold.

14. The channel protection device for processor branch prediction according to claim 13, characterized in that: The prediction module is specifically used to refresh the pipeline if the pseudo-random number is greater than or equal to the preset threshold; If the pseudo-random number is less than the preset threshold, continue to execute subsequent instructions.

15. A chip comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the processor implements the steps of the channel protection method for processor branch prediction according to any one of claims 1 to 8.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the channel protection method for processor branch prediction according to any one of claims 1 to 8 are implemented.

Images