Processor chip defense method for ghost attack based on control flow error prediction

Abstract

The invention discloses a processor chip defense method for ghost attack based on control flow misprediction, and belongs to the field of computer system structure security. The method comprises the following steps of: performing key security control in a register renaming stage, an instruction transmitting stage and an execution finishing stage of a processor: firstly, dynamically allocating an NSESL level for each instruction, and judging whether to label a target register according to the NSESL level; secondly, in an instruction transmitting stage, whether the transmission instruction is allowed to be transmitted is judged based on the NSESL and the label state; finally, after the branch instruction is analyzed, the NSESL of the instruction in the reservation station is decreased progressively, and label clearing operation is executed. The method is suitable for a processor architecture supporting out-of-order execution and branch prediction, and on the premise that the performance is not obviously influenced, speculation execution security threats caused by ghost attacks based on control flow misprediction are effectively resisted.

Description

Technical Field

[0001] This invention belongs to the field of processor architecture, and specifically relates to a processor chip defense method and electronic device for Spectre attacks based on control flow misprediction. Background Technology

[0002] The discovery of transient execution attacks in modern processors has garnered widespread attention from academia and industry, with Spectre and Meltdown attacks being the most representative examples. These attacks span multiple mainstream instruction set architectures (ISAs), including x86 (Intel and AMD), ARM, and RISC-V, affecting platforms ranging from mobile devices to desktop computers and even server and cloud computing environments. Both Spectre and Meltdown attacks exploit the speculative execution mechanism widely used in modern high-performance CPUs, executing speculative paths before instructions are formally confirmed, thus posing a serious risk of information leakage. Furthermore, with ongoing research, scholars have proposed numerous variant attacks, which can be divided into two main categories based on the triggering mechanism of transient execution: one is Meltdown-type attacks triggered by microarchitectural anomalies, with representative examples including Foreshadow, MDS, and LVI; the other is Spectre-type attacks triggered by hardware misprediction, extensively utilizing the mispredictive behavior of control flow prediction components (such as branch prediction units, BPU) and data flow prediction components. These attacks share a common characteristic: attackers carefully construct microarchitectural states to induce processors into erroneous speculative paths, accessing and leaking sensitive information that should not have been exposed during a fleeting execution window.

[0003] Currently, Meltdown attacks can be defended against by handling exceptions earlier in the processor pipeline, and many CPU manufacturers have introduced hardware fixes in their subsequent products to address this type of vulnerability. However, Spectre attacks are significantly more difficult to defend against because they rely on prediction mechanisms to trigger speculative execution, affecting a wide range of components and employing diverse attack paths. In particular, the branch prediction units on which control flow misprediction relies have complex structures and their states can be shared. This allows attackers to construct addresses and historical information sharing the prediction state, inject malicious prediction results, and further induce victims to access sensitive data in a momentary execution path, transmitting and recovering it through covert channels in the microarchitecture.

[0004] Therefore, how to systematically defend against Spectre-type attacks based on misprediction of control flow and data flow while ensuring processor performance has become an important research topic in the field of microarchitecture security. Existing solutions have high performance overhead, consume a lot of storage resources, and have low practicality. Summary of the Invention

[0005] This invention provides a processor chip defense method and electronic device against Spectre attacks based on control flow misprediction, aiming to solve the problem of sensitive data leakage caused by speculative execution of control flow in the prior art. This method introduces Nested Speculative Execution Security Level (NSESL) and a register tagging mechanism to block the transmission path at the hardware level, preventing secret data from forming a microarchitecture-level side channel through transmission instructions in the speculative path.

[0006] A processor chip defense method against Spectre attacks based on control flow misprediction includes the following steps:

[0007] Step 1: Assign a Nested Speculative Execution Security Level (NSESL) to each instruction. The initial value is 0, and it is dynamically updated according to the following rules: If the current branch instruction enters speculative execution for the first time, set its NSESL value to 1; if the condition variable of the branch instruction depends on the return value of the high-risk instruction and its NSESL value is not 0, increment its NSESL value by one; if the current instruction is a non-branch instruction, inherit the NSESL value of the previous instruction.

[0008] Step 2: After a branch instruction with NSESL=1 is parsed, decrement the NSESL value of all instructions in the hold station by one.

[0009] Step 3: During the instruction dispatch phase, the destination register of the instruction is tagged if any of the following conditions are met: the instruction is a high-risk instruction (i.e., a memory access instruction that may access secret data in a speculative path); or the source operand of the instruction contains a tagged register.

[0010] Step 4: During the transmit phase, for the transmission command, determine whether to allow transmission according to the following rules: If the NSESL value of the command is 1 and all source registers are not tagged, then transmission is allowed; if the NSESL value of the command is 1 but at least one source register has been tagged, then transmission is prohibited; if the NSESL value of the command is greater than 1, then transmission is prohibited.

[0011] Step 5: After the branch instruction with NSESL=1 is parsed, clear the tag on its destination register, and iterate through the destination register tags of instructions at higher NSESL levels in order of NSESL until there are no new tags to clear.

[0012] Step 6: After completing tag removal, reassess the transmission conditions of all commands in the reserved station and allow transmission commands that meet the conditions to continue to be transmitted and executed.

[0013] Furthermore, in step 1, the high-risk instruction refers to a memory access instruction that may access secret data in the speculative execution path, and its return value can be used by subsequent instructions and cause the transmission of secret data.

[0014] Furthermore, the transmission instructions in step 4 refer to instructions whose execution latency may be affected by secret data and which can transmit information through the microarchitecture side channel, including but not limited to: memory access instructions; floating-point operation instructions; vector calculation instructions, the specific implementation of which depends on the processor architecture, such as Intel's AVX instructions.

[0015] Furthermore, the method is used to defend against Spectre-type attacks based on branch misprediction. Its typical execution flow includes: "misprediction phase": speculative execution of branch instructions entering the wrong path; "access phase": high-risk instructions access secret data in the speculative path; "transmission phase": transmission instructions leak secret information through the microarchitecture side channel.

[0016] Furthermore, the NSESL update and rollback process in step 4 is dynamically maintained by the hardware logic within the processor and works in conjunction with the branch prediction unit, the reserved station, and the register renaming logic.

[0017] Furthermore, the tag clearing operation in step 5 adopts a recursive approach, starting from the branch instruction with NSESL=1 and propagating to higher levels to ensure that the restricted transmission instruction is reactivated after the instruction state is safely restored.

[0018] Furthermore, the operation of re-determining the transmission command transmission conditions in step 6 is completed automatically by hardware without software intervention.

[0019] Furthermore, the method is software transparent and requires no modification to the operating system, application program, or compiler instruction generation logic.

[0020] A storage medium storing a computer program, wherein the computer program executes the processor chip defense method described above against Spectre attacks based on control flow misprediction.

[0021] An electronic device includes a memory and a processor, the memory storing a computer program, and the processor being configured to run the computer program to perform the aforementioned processor chip defense method against Spectre attacks based on control flow misprediction.

[0022] Compared with existing defenses against Spectrum attacks based on control flow misprediction, the advantages of this invention are:

[0023] The control mechanism of this invention is entirely implemented in hardware. The dynamic updating, tag propagation, and clearing of NSESL are all automatically handled by the processor's internal logic, ensuring the method's software transparency. No modifications are required to the operating system, compiler, or application, demonstrating excellent versatility and deployability.

[0024] This invention utilizes a refined control mechanism at the hardware level to identify, block, and recover from Spectre attack paths based on control flow misprediction. Under the premise of ensuring acceptable performance, it provides an effective, universal, and low-overhead processor-level defense solution.

[0025] This invention has been deployed and tested on a hardware FPGA prototype and is practical. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the NESEL update rule proposed in this invention;

[0027] Figure 2 This is a schematic diagram illustrating the security mechanism proposed in this invention applied to an instance of the SonicBOOM processor core. Detailed Implementation

[0028] To make the objectives, technical solutions, and key points of this invention clearer, and to better understand the design concept and implementation of the processor chip defense method and electronic device proposed in this invention, the embodiments of this invention will be described in detail below with reference to the accompanying drawings and specific structures. It should be understood that the specific embodiments described herein are only for explaining this invention and are not intended to limit this invention.

[0029] Example 1: See Figure 1 , Figure 2 A processor chip defense method against Spectre attacks based on control flow misprediction includes the following steps:

[0030] Step 1: Assign a Nested Speculative Execution Security Level (NSESL) to each instruction. The initial value is 0, and it is dynamically updated according to the following rules: If the current branch instruction enters speculative execution for the first time, set its NSESL value to 1; if the condition variable of the branch instruction depends on the return value of the high-risk instruction and its NSESL value is not 0, increment its NSESL value by one; if the current instruction is a non-branch instruction, inherit the NSESL value of the previous instruction.

[0031] Step 2: After a branch instruction with NSESL=1 is parsed, decrement the NSESL value of all instructions in the hold station by one.

[0032] Step 3: During the instruction dispatch phase, the destination register of the instruction is tagged if any of the following conditions are met: the instruction is a high-risk instruction (i.e., a memory access instruction that may access secret data in a speculative path); or the source operand of the instruction contains a tagged register.

[0033] Step 4: During the transmit phase, for the transmission command, determine whether to allow transmission according to the following rules: If the NSESL value of the command is 1 and all source registers are not tagged, then transmission is allowed; if the NSESL value of the command is 1 but at least one source register has been tagged, then transmission is prohibited; if the NSESL value of the command is greater than 1, then transmission is prohibited.

[0034] Step 5: After the branch instruction with NSESL=1 is parsed, clear the tag on its destination register, and iterate through the destination register tags of instructions at higher NSESL levels in order of NSESL until there are no new tags to clear.

[0035] Step 6: After completing tag removal, reassess the transmission conditions of all commands in the reserved station and allow transmission commands that meet the conditions to continue to be transmitted and executed.

[0036] In step 1, a high-risk instruction refers to a memory access instruction that may access secret data in a speculative execution path. Its return value can be used by subsequent instructions and lead to the transfer of secret data.

[0037] In step 4, the transmission instructions refer to instructions whose execution latency may be affected by secret data and which can transmit information through the microarchitecture side channel, including but not limited to: memory access instructions; floating-point operation instructions; vector calculation instructions. Their specific implementation depends on the processor architecture, such as Intel's AVX instructions.

[0038] The method is used to defend against Spectre-type attacks based on branch misprediction. Its typical execution flow includes: "misprediction phase": speculative execution of branch instructions entering the wrong path; "access phase": high-risk instructions access secret data in the speculative path; "transmission phase": transmission instructions leak secret information through the microarchitecture side channel.

[0039] In step 4, the update and rollback process of NSESL is dynamically maintained by the hardware logic within the processor and works in conjunction with the branch prediction unit, reserved station, and register renaming logic.

[0040] In step 5, the tag clearing operation adopts a recursive approach, starting from the branch instruction with NSESL=1 and propagating to higher levels to ensure that the restricted transmission instruction is reactivated after the instruction state is safely restored.

[0041] The operation of re-evaluating the transmission command transmission conditions in step 6 is completed automatically by hardware and requires no software intervention.

[0042] The method is software transparent and requires no modification to the operating system, application program, or compiler instruction generation logic.

[0043] Example 2: A storage medium storing a computer program, wherein the computer program executes the above-described method.

[0044] Example 3: An electronic device includes a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the above-described method.

[0045] Example 4: This invention mainly includes four aspects: 1) It proposes Nested Speculative Execution Safety Level (NSESL) as an internal state of the processor to distinguish different speculative depths; 2) It designs an NSESL allocation and propagation mechanism and realizes state tracking in the reserved station and register renaming stages; 3) Based on the combined state of NSESL and register labels, it realizes fine control over the transmission instruction issuance behavior; 4) It designs a label clearing mechanism, which triggers iterative label clearing through speculative branch parsing to restore the system state.

[0046] The solution adopted by this invention to solve its technical problem mainly includes the following:

[0047] 1) Definition and update mechanism of Nested Speculative Execution Security Level (NSESL)

[0048] This invention introduces a Nested Speculative Execution Security Level (NSESL) into the processor pipeline, with an initial value of 0, to indicate the speculative depth of an instruction. The NSESL update rules are as follows: Figure 1 As shown.

[0049] During the instruction decoding phase, the processor dynamically updates the NSESL value for each instruction according to the following rules: if the current instruction is a branch instruction and it is the first time entering a speculative path (e.g., predicted as pending by the branch predictor), then NSESL is set to 1; if the condition variable of the branch instruction depends on the return value of a high-risk instruction (e.g., a memory access instruction or its data dependency chain) and NSESL is not 0, then the NSESL value is incremented by one; if the current instruction is a non-branch instruction, then the NSESL value of the previous instruction is inherited.

[0050] Taking the SonicBOOM processor core as an example, its micro-operations include the br_mask field. This invention reuses this field to indicate changes in the speculative level and sets NSESL from 0 to 1 when the instruction first enters the speculative path.

[0051] When branch resolution is complete and NSESL = 1, all unexecuted instructions in the reserved station will have their NSESL value decremented by one, thus indicating a rollback of the speculative path.

[0052] (ii) Register tag mechanism and its propagation mechanism

[0053] During the register renaming phase, this invention introduces a 1-bit security tag for each physical register to record whether the register contains potential secret information.

[0054] The specific tagging rules are as follows: If the current instruction is a high-risk instruction (e.g., a memory access instruction that may access secret data), its destination register is tagged; if the source register of the current instruction contains a tagged register (i.e., its dependency path may leak secrets), then its destination register also inherits the tag.

[0055] The tagging operation is completed during the register renaming stage, and works in conjunction with the NSESL state to influence subsequent transmit control logic.

[0056] (iii) NSESL-based tag-based transmission control mechanism

[0057] During the instruction issue phase, the processor retainer, in addition to the existing "checking whether the source operands are ready", introduces the following issue rule:

[0058] For transmission instructions, including memory access instructions, floating-point arithmetic instructions, and vector instructions, the issue conditions are as follows: if NSESL = 1 and all source registers are untagged, then issue is allowed; if NSESL = 1 but at least one source register is tagged, then issue is prohibited; if NSESL > 1, then issue is prohibited regardless of the tag status of the source registers.

[0059] This mechanism prevents sensitive data from being leaked to the microarchitectural observable state (such as caches, TLBs, etc.) before exiting the speculative path, thus defending against Spectre attacks based on control flow misprediction.

[0060] (iv) Tag removal mechanism and launch condition reassessment mechanism

[0061] After the branch instruction with NSESL=1 is parsed, the processor performs a tag clearing operation according to the following rules: clear the tag on the destination register of the branch; iterate upwards according to the NSESL level to clear the tagged destination register tags until there are no more tags that meet the conditions to be cleared.

[0062] This invention proposes to complete the process sequentially based on the ROB (Reorder Buffer). After tag clearing is completed, the holding station needs to reassess the transmission conditions of all current transmission commands. For commands whose tags have been cleared and whose NSESL status meets the conditions, they are allowed to continue transmission and execution.

[0063] The specific steps are illustrated below with examples.

[0064] like Figure 2 As shown, this design expands the NSESL and tag storage fields on the original reserved station structure of the SonicBOOM processor core. The gray area and dashed arrow in the figure indicate the new logical path. The above changes have little impact on the original out-of-order execution flow, and the storage space overhead of this design is extremely small.

[0065] In the SonicBOOM processor, each instruction is assigned a Nested Speculative Execution Security Level (NSESL) during the decoding phase, with an initial value of 0. When a branch instruction first enters the speculative path, its NSESL is set to 1; if the branch instruction depends on the return value of a tagged high-risk instruction, the NSESL of the previous instruction is incremented by 1; non-branch instructions inherit the NSESL of the previous instruction.

[0066] During the register renaming phase, when SonicBOOM allocates physical registers for each instruction, it writes NSESL information to the reserved station and determines whether to tag the destination register according to security rules: when the instruction is a high-risk instruction or its source operands contain tagged registers, the destination register must be tagged.

[0067] During the transmit phase, the reserved station of SonicBOOM not only determines whether the operands are ready, but also determines whether to allow the transmit instruction based on the NSESL of the instruction and the tag status of the source registers: if NSESL is 1 and all source registers are untagged, then transmit is allowed; if NSESL is 1 and any source register is tagged, or if NSESL is greater than 1, then transmit is prohibited.

[0068] When a branch instruction with NSESL equal to 1 is parsed, SonicBOOM decrements the NSESL value of all unexecuted instructions in the reserved station by 1 to indicate that the branch path has been safely terminated and restores a shallower speculative context.

[0069] At the same time, SonicBOOM initiates the tag clearing logic, first clearing the tag on the destination register of the branch instruction, and then recursively clearing the tags on the destination registers of related instructions in higher NSESL levels until there are no tags left to clear.

[0070] After the tag is cleared, SonicBOOM will re-examine all unissued transmission commands in the reserved station, re-evaluate their issuance conditions based on the latest tag status and NSESL value, and allow commands that meet the security rules to be issued, ensuring that no information leakage occurs in the processor's execution path.

Claims

1. A processor chip defense method against Spectre attacks based on control flow misprediction, characterized in that, The method includes the following steps: Step 1: Assign a Nested Speculative Execution Security Level (NSESL) to each instruction. The initial value is 0, and it is dynamically updated according to the following rules: If the current branch instruction enters speculative execution for the first time, set its NSESL value to 1; if the condition variable of the branch instruction depends on the return value of the high-risk instruction and its NSESL value is not 0, increment its NSESL value by one; if the current instruction is a non-branch instruction, inherit the NSESL value of the previous instruction. Step 2: After a branch instruction with NSESL=1 is parsed, decrement the NSESL value of all instructions in the hold station by one. Step 3: During the instruction dispatch phase, the destination register of the instruction is tagged if any of the following conditions are met: the instruction is a high-risk instruction, i.e., a memory access instruction that may access secret data in a speculative path; or the source operand of the instruction contains a tagged register. Step 4: During the transmit phase, for the transmission command, determine whether to allow transmission according to the following rules: If the NSESL value of the command is 1 and all source registers are not tagged, then transmission is allowed; if the NSESL value of the command is 1 but at least one source register has been tagged, then transmission is prohibited; if the NSESL value of the command is greater than 1, then transmission is prohibited. Step 5: After the branch instruction with NSESL=1 is parsed, clear the tag on its destination register, and iterate through the destination register tags of instructions at higher NSESL levels in order of NSESL until there are no new tags to clear. Step 6: After completing tag removal, reassess the transmission conditions of all commands in the reserved station and allow transmission commands that meet the conditions to continue to be transmitted and executed.

2. The processor chip defense method against Spectre attacks based on control flow misprediction as described in claim 1, characterized in that, In step 1, a high-risk instruction refers to a memory access instruction that may access secret data in a speculative execution path. Its return value can be used by subsequent instructions and lead to the transfer of secret data.

3. The processor chip defense method against Spectre attacks based on control flow misprediction as described in claim 1, characterized in that, In step 4, the transmission instructions refer to instructions whose execution latency may be affected by secret data and which transmit information through the microarchitecture side channel. These include: memory access instructions; floating-point operation instructions; and vector calculation instructions. Their specific implementation depends on the processor architecture.

4. The processor chip defense method against Spectre attacks based on control flow misprediction as described in claim 1, characterized in that, The method is used to defend against Spectre-type attacks based on branch misprediction. The execution process includes: "misprediction phase": speculative execution of branch instructions entering the wrong path; "access phase": high-risk instructions access secret data in the speculative path; "transmission phase": transmission instructions leak secret information through the microarchitecture side channel.

5. The processor chip defense method against Spectre attacks based on control flow misprediction as described in claim 1, characterized in that, In step 4, the update and rollback process of NSESL is dynamically maintained by the hardware logic within the processor and works in conjunction with the branch prediction unit, reserved station, and register renaming logic.

6. The processor chip defense method against Spectre attacks based on control flow misprediction as described in claim 1, characterized in that, In step 5, the tag clearing operation adopts a recursive approach, starting from the branch instruction with NSESL=1 and propagating to higher levels to ensure that the restricted transmission instruction is reactivated after the instruction state is safely restored.

7. The processor chip defense method against Spectre attacks based on control flow misprediction as described in claim 1, characterized in that, The operation of re-evaluating the transmission command transmission conditions in step 6 is completed automatically by hardware and requires no software intervention.

8. The processor chip defense method against Spectre attacks based on control flow misprediction as described in claim 1, characterized in that, The method is software transparent and requires no modification to the operating system, application program, or compiler instruction generation logic.

9. A storage medium storing a computer program, wherein the computer program performs any one of the methods of claims 1-8.

10. An electronic device comprising a memory and a processor, the memory storing a computer program, the processor being configured to run the computer program to perform any one of the methods of claims 1-8.

Images