A Spectre vulnerability protection system and method based on fixed point algorithm

Abstract

The present invention discloses a Spectre vulnerability protection system and method based on a fixed point algorithm, relates to the technical field of computer attack security analysis, and solves the technical problem that the prior art fails to distinguish whether a protection statement has a Spectre vulnerability when protecting a program, thereby causing excessive statement protection and program performance loss. The present invention obtains a program from a database, marks the program with sensitive information, and tracks the sensitive information based on a bit granularity algorithm to obtain a secret value; retrieves a security domain, sets a security level label, determines a state domain according to the security level label, sequentially executes the program to obtain an over-estimated value; calculates a state transition of the program configuration according to the over-estimated value; obtains the protected program based on a fixed point, and adds defense to the program according to the fixed point; the present invention specifically protects statements that may cause Spectre vulnerabilities, thereby reducing performance loss caused by protection.

Description

Technical Field

[0001] The present invention belongs to the field of computer system microarchitecture attack security analysis and relates to computer security analysis technology, specifically a Spectre vulnerability protection system and method based on a fixed point algorithm. Background Art

[0002] The Spectre vulnerability allows attackers to maliciously obtain sensitive data from the system by exploiting performance optimization technologies such as branch prediction and speculative execution in the processor;

[0003] The protection system based on the fixed-point algorithm can target the attack mechanism of the Spectre vulnerability and effectively identify and prevent potential attack behaviors by accurately analyzing the state transitions and sensitive information flows during program execution; ensuring that sensitive data will not be illegally accessed or leaked during program execution, thereby significantly improving the security of the system; through in-depth analysis of the program through the fixed-point algorithm, potential vulnerabilities and errors can be discovered and fixed in a timely manner, reducing the risk of system crashes and failures, helping to improve the overall stability and reliability of the system and ensuring that the system can operate continuously and stably.

[0004] The existing technology prevents the processor from ghostly executing the statements after the barrier by adding barrier statements to the code; LLVM[1] and GCC[2] now provide corresponding compilation options to add such barrier statements to the program; in addition, LLVM also provides a protection measure called SLH, which protects the program by introducing data dependencies between branch instructions and load instructions; however, when protecting the program, the existing technology does not distinguish whether the protected statements have ghost vulnerabilities, which leads to the technical problem of excessive statement protection and program performance loss.

[0005] The present invention provides a Spectre vulnerability protection system and method based on a fixed point algorithm to solve the above technical problems. Summary of the Invention

[0006] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the present invention proposes a Spectre vulnerability protection system and method based on a fixed point algorithm, which is used to solve the technical problem that the prior art does not distinguish whether the protected statements contain Spectre vulnerabilities when protecting the program, thereby resulting in excessive statement protection and causing program performance loss.

[0007] To achieve the above-mentioned object, a first aspect of the present invention provides a Spectre vulnerability protection system based on a fixed point algorithm, comprising: a sensitive information tracking module, a state transfer module, and a fixed point defense module;

[0008] Sensitive information tracking module: obtains programs from the database, marks them with sensitive information, tracks sensitive information based on a bit-granularity algorithm, and obtains secret values;

[0009] State transition module: retrieves the security domain, sets the security level label, determines the state domain based on the security level label, executes the program sequentially to obtain the over-estimated value; calculates the state transition of the program configuration based on the over-estimated value;

[0010] Fixed point defense module: obtains the protected program based on the fixed point, and adds defense to the program according to the fixed point.

[0011] Preferably, the system includes: a user operation module: used to configure sensitive information; start the execution of sensitive information tracking, state transition analysis and fixed point defense modules; monitor the analysis progress in real time, and view the operating status and log information of each module.

[0012] The present invention checks the operating status and log information of each module so as to deal with possible problems in a timely manner.

[0013] Preferably, the sensitive information tracking based on the bit granularity algorithm includes:

[0014] Align the program's buffer with the cache line boundary, randomly obtain a window size that is divisible by the cache line size, and divide the buffer into different indices; obtain the secret value and scatter the secret value into different indices through hash operations; reconstruct the complete secret value by sequentially accessing the indices and mark it as p.

[0015] It should be noted that the variable p in the program serves as a key and will be marked as sensitive information when the program is initially executed.

[0016] The present invention reconstructs the complete p-value by sequentially accessing these indexes during the retrieval process, without relying on the specific secret value. This access pattern is used to prevent the leakage of secret values ​​through temporal analysis. It also illustrates the importance of accurately tracking which bits of a value may expose sensitive information when analyzing whether instructions are at risk of side-channel attacks. Bit-granularity algorithms can accurately track and obtain sensitive information in such algorithms.

[0017] Preferably, determining the status domain according to the security level label includes:

[0018] Obtain the program configuration from the database, marked as Ω, retrieve the security domain of Ω, and assign a security level label to each bit of each data using taint tracking technology; the security level label includes: sensitive information H, non-sensitive information L, value 0, value 1;

[0019] Determine whether all data labeled 0 or 1 have corresponding values; if so, mark the corresponding security domain as legal; if not, mark the corresponding security domain as illegal.

[0020] Determine whether the value of the bit labeled H will change when the corresponding calculation result changes the value of the bit labeled L; if so, the corresponding security domain is coherent; if not, the corresponding security domain is incoherent;

[0021] Determine whether the security domain satisfies both legality and irrelevance. If so, the corresponding security domain is complete and the corresponding security domain is used as the state domain. If not, the corresponding security domain is incomplete.

[0022] By verifying legitimacy, the present invention ensures that all data labeled 0 or 1 have corresponding values. That is, a bit with a value of 0 will not be labeled 1, and a bit with a value of 1 will not be labeled 0. Incoherence ensures that if the value of a bit labeled H changes, the calculation result will not affect the value of the bit labeled L. By formally designing the calculation on the domain, this hierarchical label can completely estimate whether each bit of each data carries confidential information.

[0023] Preferably, the sequential execution of the program to obtain the estimated value includes:

[0024] S110: Retrieve the status field and initialize is the lowest value on the state domain and is marked as an empty state; where n represents the nth statement of the program; Indicates the program status corresponding to the nth statement after the program is executed;

[0025] S120: Determine whether n is 0; if yes, initialize Is empty; otherwise, initialize is s; where s represents the initial state of the program;

[0026] S130: Determine whether n exists such that ; If yes, then Assign to , and by the formula Calculate the new state of the program; if not, continue to judge; TransSeq is the state transition rule function specified by the semantics under sequential execution; mark the new state as an over-estimated value and mark it as ; is the predecessor of n, For the predecessor node Current status , update the state of this node n at the next moment .

[0027] Preferably, the state transfer configured according to the over-estimated value calculation program includes:

[0028] Mark the program configuration as Ω and the statement that currently needs to be protected as K. Determine whether the corresponding statement marked as sensitive information appears in K. If so, mark the corresponding statement as protected and use the over-estimated value after sequential execution to calculate the state of the program configuration after the corresponding statement is executed. If not, mark the corresponding statement as unprotected and use the operational semantics under ghost execution to calculate the state of the program configuration after the corresponding statement is executed.

[0029] It should be noted that the corresponding statements for sensitive information are set by staff based on actual work conditions.

[0030] Preferably, the step of retrieving the over-estimated value after sequential execution to calculate the state of the program configuration after the corresponding statement is executed includes:

[0031] initialization is the lowest value in the state domain and is marked as an empty state; determine whether n is 0; if so, initialize Is empty; otherwise, initialize is s; where s represents the initial state of the program;

[0032] initialization and Are all empty sets, determine whether there is n such that ,or When the status is updated: Statements that need to be protected after state transfer;

[0033] Retrieve , through the formula Calculate the new state after the transfer; among them, represents the least upper bound operation on the domain, pred represents all the predecessor instructions of the nth instruction; TransHK represents the transformation function with the knowledge that some statements will be protected;

[0034] judge and (n) Whether it remains consistent; if so, mark the corresponding new state as a fixed point; if not, continue to judge.

[0035] Preferably, the use of operational semantics under ghost execution to calculate the state of the program configuration after the corresponding statement is executed includes:

[0036] S210: Retrieve the status field and initialize is the lowest value on the state domain and is marked as an empty state;

[0037] S220: Determine whether n is 0; if yes, initialize Is empty; otherwise, initialize for s;

[0038] S230: Determine whether n exists such that ; If yes, then Assign to , and by the formula Calculate the new state of the program; otherwise, continue judging; where TransSpec is the transfer function specified by the operational semantics under ghost execution.

[0039] Preferably, the procedure for obtaining protection based on the fixed point includes:

[0040] Retrieved estimated value , mark the function corresponding to the attacker model and protection strategy as H ( ); K represents the statement currently marked as needing protection;

[0041] By formula The fixed point binary tuple reached after the state transfer is calculated, and the program is defended by the fixed point binary tuple to obtain the protected program.

[0042] After calculating a new Ω each time, the present invention calculates an updated K based on the current program state Ω through H(), thereby obtaining statements that may cause leakage during ghost execution, protecting these statements, and increasing the confidentiality of the entire program.

[0043] To achieve the above objectives, a second aspect of the present invention provides a Spectre vulnerability protection method based on a fixed point algorithm, comprising:

[0044] Obtain the program from the database, mark the program with sensitive information, track the sensitive information based on the bit granularity algorithm, and obtain the secret value;

[0045] Retrieve the security domain, set the security level label, determine the state domain according to the security level label, and execute the program sequentially to obtain the estimated value;

[0046] Calculate state transitions of program configurations based on over-estimated values;

[0047] Get the protected program based on the fixed point, and add defense to the program based on the fixed point.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] 1. By obtaining programs from a database and using a sensitive information identification system to mark sensitive information in the programs, it is possible to ensure that in the subsequent analysis and protection process, these sensitive data are focused on to prevent them from being exploited by security threats such as Spectre vulnerabilities. The accuracy of sensitive information marking is crucial for subsequent security protection, as it can help the system quickly identify and locate potential security risks. The present invention simultaneously detects and defends against Spectre vulnerabilities in programs, and only defends against statements that are identified as causing Spectre vulnerabilities, thereby reducing performance losses caused by defense. At the same time, the present invention is flexible and can protect programs based on different attacker models and different defense measures.

[0050] 2. Tracking sensitive information based on bit-granularity algorithms: Bit-granularity algorithms enable precise tracking of sensitive information in programs, ensuring that the flow and state changes of sensitive data can be accurately captured during program execution. By retrieving security domains and setting security level labels based on the sensitivity and importance of the data, different data in the program can be divided into security levels, which helps the system take corresponding protective measures for the corresponding levels to ensure the security of data during storage, transmission and processing. By analyzing the state transitions of program configurations, the conversion relationship between various states during program execution can be understood, thereby discovering potential security vulnerabilities and attack paths, which helps the system conduct more in-depth security assessments of the program and take corresponding protective measures to eliminate or mitigate these vulnerabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0052] Figure 1 This is a flow chart of the Spectre vulnerability protection process of the present invention;

[0053] Figure 2 This is a schematic diagram of the specific steps of sensitive information tracking in the present invention;

[0054] Figure 3 Schematic diagram of the specific steps of the state transfer process of the present invention;

[0055] Figure 4 This is a schematic diagram of the relationship between the modules included in the present invention. DETAILED DESCRIPTION

[0056] The technical solutions of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0057] See also Figure 1 , an embodiment of a first aspect of the present invention provides a Spectre vulnerability protection system based on a fixed point algorithm, comprising: a sensitive information tracking module, a state transfer module, and a fixed point defense module;

[0058] Sensitive information tracking module: obtains programs from the database, marks them with sensitive information, tracks sensitive information based on a bit-granularity algorithm, and obtains secret values;

[0059] State transition module: retrieves the security domain, sets the security level label, determines the state domain based on the security level label, executes the program sequentially to obtain the over-estimated value; calculates the state transition of the program configuration based on the over-estimated value;

[0060] Fixed point defense module: obtains the protected program based on the fixed point, and adds defense to the program according to the fixed point.

[0061] See also Figure 2 The specific steps of sensitive information tracking are: obtain the program from the database, mark the input program with sensitive information, align the program buffer with the cache line boundary, randomly obtain a window size that can be divided by the cache line size, and divide the buffer into different indexes; obtain the secret value, and disperse the secret value into different indexes through hash operations; reconstruct the complete secret value by accessing the indexes in sequence.

[0062] For example, the buffer is aligned to the cache line boundary through the align function, a window that is divisible by the cache line size is determined, and the buffer is divided into different indices; the secret value is scattered to different indices through a hash operation based on the scatter function, such as scattering the i-th byte of p to the i-th index of buf; the complete p value is reconstructed by sequentially accessing these indices through the gather function without relying on the specific secret value k;

[0063] For the above algorithm, k is used as the key and is initially marked as sensitive;

[0064] The existing code A is as follows:

[0065] 1 align(char buf){

[0066] 2 return buf-(buf&(block_size-1))+block_size;

[0067] 3}

[0068] 4 scatter(char buf,char p,int k,int window){

[0069] 5 for(i=θ;i <N;i++)

[0070] 6 buf[k+i window]=p[i];

[0071] 7}

[0072] 8 gather(char buf,char p,int k,int window){

[0073] 9 for(i=θ;i <N;i++)

[0074] 10 p[i]=buf[k+i window];

[0075] 11}

[0076] Take the expression k+i in code A Taking windows as an example, in the implementation, k is a 6-bit integer, the label of each bit is H, and the value of windows is 1<<6=64, then the bit granularity tracking algorithm will determine i The lower 6 bits of windows=i<<6 are labeled as 0, and the higher bits are labeled as L, so we can analyze and get k+i For the result of the windows expression, only the lower 6 bits are sensitive, because the lower 6 bits are not used as cache indexes, so using this value for memory access will not cause information leakage.

[0077] See also Figure 3 ,Specific steps of the state transfer process, S110: call the state domain, initialize is the lowest value on the state domain and is marked as an empty state; where n represents the nth statement of the program; Indicates the program status corresponding to the nth statement after the program is executed;

[0078] S120: Determine whether n is 0; if yes, initialize Is empty; otherwise, initialize is s; where s represents the initial state of the program;

[0079] S130: Determine whether n exists such that ; If yes, then Assign to , and by the formula Calculate the new state of the program; if not, continue to judge; TransSeq is the state transition rule function specified by the semantics under sequential execution; mark the new state as an over-estimated value and mark it as ; is the predecessor of n, For the predecessor node Current status , update the state of this node n at the next moment ; Mark the program configuration as Ω and the statement that currently needs to be protected as K; determine whether the corresponding statement marked as sensitive information appears in K; if so, mark the corresponding statement as protected, and call the over-estimated value after sequential execution to calculate the state of the program configuration after the execution of the corresponding statement; if not, mark the corresponding statement as unprotected, and use the operational semantics under ghost execution to calculate the state of the program configuration after the execution of the corresponding statement.

[0080] For example, there is a code B as follows:

[0081] 1 unsigned short a[8];

[0082] 2 unsigned short b

[256] ;

[0083] 3 unsigned short c

[256] ;

[0084] 4 int foo(int x){

[0085] 5 unsigned short y,z,w=θ;

[0086] 6 if(x<8){

[0087] 7 y=a[x];

[0088] 8 z=b[y];

[0089] 9 w=c[z];

[0090] 10}

[0091] 11 return w;

[0092] 12}

[0093] By using TransHK to calculate the state transition of the program state;

[0094] In the first iteration, during ghost execution, when x>=8, the program may also ghostly execute statements in lines 7, 8, and 9. In this case, the access of y=a[x] will be out of bounds and may read sensitive content, so each bit of y will be marked as H. At this time, by calculating H(Ω), it is determined that the memory access b[y] will leak the value of y (marked as H) through the cache side channel, so line 8 is added to K.

[0095] Therefore, in the next iteration, when TransHK is used to calculate the range of z, according to the rules of TransHK, since line 8 is in K, the calculation of the range of z will directly use the preprocessed result: that is, the range of z is [0, 255], and each bit is marked as L. Furthermore, the range of w is also [0, 255], and each bit is marked as L. Since no new variables are marked as sensitive, the updated K remains unchanged;

[0096] Repeat the above iterations until the status of each statement and K no longer change.

[0097] The specific steps of program defense for fixed point binary, calling over-estimated values , the function corresponding to the attacker model and the protection strategy is marked as H ( ); Ω represents the program configuration, and K represents the statement currently marked as needing protection;

[0098] By formula The fixed point binary tuple reached after the state transfer is calculated, and the program is defended by the fixed point binary tuple to obtain the protected program.

[0099] For example, call code B, mark arrays a, b, and c as non-sensitive information (L), and mark all contents except arrays a, b, and c as sensitive information (H). In sequential execution, due to the constraint x<8, y=a[x] in line 7 is a memory access within array a, so the range of y is [0, 255], and each bit of y is marked as L. Furthermore, the memory accesses of b[y] and c[z] are both within arrays b and c. Similarly, the range of z and w is [0, 255], and each bit is marked as L.

[0100] During ghost execution, when x>=8, the program may ghostly execute statements in lines 7, 8, and 9. At this point, the access to y=a[x] will be out of bounds, potentially reading sensitive content, so each bit of y will be marked as H. By calculating H(Ω), we determine that the memory access b[y] will leak the value of y (marked as H) through a cache side channel, so we add line 8 to K. Therefore, when calculating the range of z, we directly use the preprocessed result: the range of z is [0, 255], with each bit marked as L. Furthermore, the range of w is also [0, 255], with each bit marked as L. In the resulting fixed point, K contains only the statement in line 8, so we only need to add protection for line 8.

[0101] When the present invention is performing the first type of Spectre vulnerability, if an ordinary protection algorithm is used, lines 7, 8, and 9 will all be considered to require protection; when set in the analysis process, without considering the change in program semantics after protection, then lines 8 and 9 will both be marked as requiring protection; the solution of the present invention specifically protects statements that may cause Spectre vulnerabilities, reducing the performance loss caused by protection.

[0102] See also Figure 4 The second embodiment of the present invention provides a Spectre vulnerability protection method based on a fixed point algorithm, comprising:

[0103] Obtain the program from the database, mark the program with sensitive information, track the sensitive information based on the bit granularity algorithm, and obtain the secret value;

[0104] Retrieve the security domain, set the security level label, determine the state domain according to the security level label, and execute the program sequentially to obtain the estimated value;

[0105] Calculate state transitions of program configurations based on over-estimated values;

[0106] Get the protected program based on the fixed point, and add defense to the program based on the fixed point.

[0107] Some of the data in the above formula are calculated by removing the dimensions and taking their numerical values. The formula is a formula that is closest to the actual situation obtained by software simulation of a large amount of collected data; the preset parameters and preset thresholds in the formula are set by technical personnel in this field according to actual conditions or obtained through simulation of a large amount of data.

[0108] The working principle of the present invention is as follows: the present invention marks the input program with sensitive information and tracks the sensitive information based on a bit-granularity algorithm; calls the security domain, sets the security level label, determines the state domain according to the security level label, and sequentially executes the program to obtain an over-estimated value; calculates the state transition of the program configuration according to the over-estimated value; obtains the protected program based on the fixed point, and adds defense to the program according to the fixed point.

[0109] The above embodiments are only used to illustrate the technical method of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A Spectre vulnerability protection system based on a fixed point algorithm, characterized in that: include: Sensitive information tracking module, state transfer module, fixed point defense module; Sensitive information tracking module: obtains programs from the database, marks them with sensitive information, tracks sensitive information based on a bit-granularity algorithm, and obtains secret values; State transfer module: retrieves the security domain, sets the security level label, determines the state domain according to the security level label, and executes the program sequentially to obtain the estimated value; Calculate state transitions of program configurations based on over-estimated values; Fixed point defense module: obtains the protected program based on the fixed point and adds defense to the program according to the fixed point; The sensitive information tracking based on the bit-granularity algorithm includes: Align the program's buffer with the cache line boundary, randomly obtain a window size that is divisible by the cache line size, and divide the buffer into different indices; obtain the secret value and distribute the secret value to different indices through hashing operations; reconstruct the complete secret value by sequentially accessing the indices and mark it as p; Execute the program sequentially to obtain estimated values, including: S110: Retrieve the status field and initialize is the lowest value on the state domain and is marked as an empty state; where n represents the nth statement of the program; Indicates the program status corresponding to the nth statement after the program is executed; S120: Determine whether n is 0; if yes, initialize Is empty; otherwise, initialize is s; where s represents the initial state of the program; S130: Determine whether n exists such that ; If yes, then Assign to , and by the formula Calculate the new state of the program; if not, continue to judge; TransSeq is the state transition rule function specified by the semantics under sequential execution; mark the new state as an over-estimated value and mark it as ; is the predecessor of n, For the predecessor node Current status , update the state of this node n at the next moment .

2. The Spectre vulnerability protection system based on the fixed point algorithm according to claim 1, characterized in that: Also includes: User operation module: used to configure sensitive information; Start the execution of sensitive information tracking, state transition analysis, and fixed point defense modules; Monitor the analysis progress in real time and view the operating status and log information of each module.

3. The Spectre vulnerability protection system based on the fixed point algorithm according to claim 1, characterized in that: Determining the state domain according to the security level label includes: Obtain the program configuration from the database, marked as Ω, retrieve the security domain of Ω, and assign a security level label to each bit of each data using taint tracking technology; the security level label includes: sensitive information H, non-sensitive information L, value 0, value 1; Determine whether all data labeled 0 or 1 have corresponding values; if so, mark the corresponding security domain as legal; if not, mark the corresponding security domain as illegal. Determine whether the value of the bit labeled H will change when the corresponding calculation result changes the value of the bit labeled L; if so, the corresponding security domain is coherent; if not, the corresponding security domain is incoherent; Determine whether the security domain satisfies both legality and irrelevance. If so, the corresponding security domain is complete and the corresponding security domain is used as the state domain. If not, the corresponding security domain is incomplete.

4. The Spectre vulnerability protection system based on the fixed point algorithm according to claim 1, characterized in that: The state transition configured according to the over-estimated value calculation program includes: Mark the program configuration as Ω and the statement that currently needs to be protected as K. Determine whether the corresponding statement marked as sensitive information appears in K. If so, mark the corresponding statement as protected, and retrieve the over-estimated value after sequential execution to calculate the state of the program configuration after the corresponding statement is executed. If not, mark the corresponding statement as unprotected, and use the operational semantics under ghost execution to calculate the state of the program configuration after the corresponding statement is executed.

5. The Spectre vulnerability protection system based on the fixed point algorithm according to claim 4, characterized in that: The method of retrieving the over-estimated value after sequential execution to calculate the state of the program configuration after the corresponding statement is executed includes: initialization is the lowest value in the state domain and is marked as an empty state; determine whether n is 0; if so, initialize Is empty; otherwise, initialize is s; where s represents the initial state of the program; initialization and Are all empty sets, determine whether there is n such that ,or When the status is updated: Statements that need to be protected after state transfer; Retrieve , through the formula Calculate the new state after the transfer; among them, represents the least upper bound operation on the domain, pred represents all the predecessor instructions of the nth instruction; TransHK represents the transformation function with the knowledge that some statements will be protected; judge and (n) Whether it remains consistent; if so, mark the corresponding new state as a fixed point; if not, continue to judge.

6. The Spectre vulnerability protection system based on the fixed point algorithm according to claim 4, characterized in that: The use of the operational semantics under ghost execution to calculate the state of the program configuration after the corresponding statement is executed includes: S210: Retrieve the status field and initialize is the lowest value on the state domain and is marked as an empty state; S220: Determine whether n is 0; if yes, initialize Is empty; otherwise, initialize for s; S230: Determine whether n exists such that ; If yes, then Assign to , and by the formula Calculate the new state of the program; otherwise, continue judging; where TransSpec is the transfer function specified by the operational semantics under ghost execution.

7. The Spectre vulnerability protection system based on the fixed point algorithm according to claim 1, characterized in that: The procedure for obtaining protection based on the fixed point includes: Retrieved estimated value , mark the function corresponding to the attacker model and protection strategy as H ( ); K represents the statement currently marked as needing protection; By formula The fixed point binary tuple reached after the state transfer is calculated, and the program is defended by the fixed point binary tuple to obtain the protected program.

8. A Spectre vulnerability protection method based on a fixed point algorithm, applied to a Spectre vulnerability protection system based on a fixed point algorithm as claimed in any one of claims 1 to 7, characterized in that: include: Obtain the program from the database, mark the program with sensitive information, track the sensitive information based on the bit granularity algorithm, and obtain the secret value; Retrieve the security domain, set the security level label, determine the state domain according to the security level label, and execute the program sequentially to obtain the estimated value; Calculate state transitions of program configurations based on over-estimated values; Get the protected program based on the fixed point, and add defense to the program based on the fixed point.

Images