Securing microprocessors against microarchitectural side-channel attacks

Abstract

A processor core for executing processes is disclosed. The processor core comprises: one or more functional data registers for storing a context of a process under execution; and one or more non-functional registers for storing non-functional data. The processor core is configured to modify at least one of the one or more non-functional registers to include data that is independent of system measurements of the processor core.

Description

SECURING MICROPROCESSORS AGAINST MICROARCHITECTURAL SIDE-CHANNELATTACKSBACKGROUND

[0001] A new security threat that has appeared in recent years against microprocessor-based systems is that of microarchitectural side-channel attacks. These exploit microarchitecture of the micro-processor that is utilized when executing different programs. Aspects of the microarchitecture that are used to execute different programs can be exploited by a malicious process to gain access to information about other processes that the processor is executing. In this document, the terms microprocessor and processor core are used interchangeably.

[0002] In microarchitectural side-channel attacks, a malicious process does not need to gain physical access to an attacked system or gain a high privilege level in the operating system (OS), but only needs to observe and access the microarchitecture components of the microprocessor during its execution. In the past seven years these attacks have become a serious threat to all those computing systems that allow third party software to be executed on the system. A malicious process can successfully attack a victim process without knowledge of the victim program’s code.

[0003] For example, some microarchitectural side-channel attacks exploit inconsistencies in the microarchitectural status of the attacked microprocessor caused by branch prediction and speculative and out-of-order execution. In a well-known microarchitectural side-channel attack called Meltdown, the malicious process takes advantage of speculative execution to break address space virtualization. By exploiting Meltdown, an attacker process can access the memory of other processes and of the operating system.

[0004] Several solutions have been proposed in recent years for securing microprocessors against microarchitectural side-channel attacks.

[0005] Some of these solutions are designed to undermine the malicious process’s ability to observe timing behavior of the microprocessor, through which the malicious process can gain access to other process’s data. One example is cache partitioning where each process has its own portion of the cache avoiding in this way the leakage of sensitive information.

[0006] Other security countermeasures rely on modifications of a protected process’s control-flow introduced at compile-time. For example, a modified compiler has been proposed that can automatically identify and remove those control flows that are highly dependent on processed data, and that, as a consequence, risk making the process’s information visible to a malicious process. In another suggested approach, a compile-time generator of equivalent but different execution paths is proposed, and at runtime one of the available execution paths is randomly chosen.

[0007] Various OS -level solutions have also been proposed to secure microprocessors against microarchitectural side-channel attacks. These include introducing random delays to obscure timing information and periodically flushing the cache to remove timing variations.

[0008] Several architecture -level proposals rely on cache coloring, in which the cache is divided into regions and data are mapped into a cache region or another depending on the application. These includeavoiding cache sharing or selectively evicting the cache based on threads, locking cache lines dynamically, and making speculation invisible in the data cache hierarchy.

[0009] Although many of these solutions are effective, they generally lead to significant performance degradation due to increased execution time, stemming for example from the limited or modified use of the cache. Typical solutions can degrade performance by 60-70%, for example. This is major disadvantage of existing security measures.

[0010] Various machine learning techniques have been proposed for detecting microarchitectural sidechannel attacks but these are only effective for detection, not prevention.

[0011] The Intel Software Guard Extension, the ARM TrustZone, and the RISC-V Security Extensions exploit classical encryption and hashing algorithms to provide protection against traditional attacks, but are not effective against microarchitectural side-channel attacks.

[0012] As such, there is a need for a security measure that is effective for protecting microprocessors against microarchitectural side-channel attacks and does not suffer from performance degradation.SUMMARY

[0013] Particular embodiments are set out in the independent claims. Various optional examples are set out in the dependent claims.

[0014] Some implementations described herein relate to a processor core for executing processes. The processor core comprises: one or more functional data registers for storing a context of a process under execution; and one or more non-functional registers for storing non-functional data. The processor core is configured to modify at least one of the one or more non-functional registers to include data that is independent of system measurements of the processor core.

[0015] The system measurements of the processor core may suitably comprise measurements of time and, additionally or alternatively, measurements of one or more performance metrics. The processor core may be configured to modify the at least one of the one or more non-functional registers by adding one or more predetermined or random values of non-functional data to the one or more non-functional registers during execution of a process. Each of the one or more predetermined values may be assigned based on an instruction under execution, the instruction being part of the process. The one or more non-functional registers may comprise one or more timing registers and at least one of the one or more values of nonfunctional data comprise at least one timing value. The at least one timing value may be based on a number of clock cycles. The processor core may be configured to increment one or more of the timing registers by a pre-determined timing value in response to executing an instruction irrespective of how long it takes the processor core to execute the instruction, the instruction being part of the process. The pre-determined time value may depend on whether the instruction comprises ‘ADD, ‘SUB, ‘LOAD, ‘STORE, ‘MUL, or ‘DIV. The processor core may be configured to not increment the timing register in response to time elapsed for implementing a cache miss resolution mechanism. The processor core may be configured to increment the timing register by a random or predetermined timing value in response to executing a memory access instruction irrespective of how long it takes the processor core to execute the memory access instruction. The one or more non-functional registers may comprise a performance counter register and at least one of the one or more values of non-functional data comprises aperformance metric value. The performance metric value may comprise a number of cache hits, a number of cache misses, or a number of retired instructions. The processor core may be configured to increment one or more of the performance counter registers by a pre -determined performance metric value in response to executing an instruction irrespective of a true performance metric of the processor core during the execution of the instruction, the instruction being part of the process. The processor core may be configured to modify the at least one of the one or more non-functional registers by allowing the at least one of the one or more non-functional registers to be accessed for read and write operations by a process with a predefined privilege level, to thereby include non-functional data in the context of the process under execution. The processor core may be configured to: cause one or more outgoing values of nonfunctional data from the one or more non-functional registers to be saved in a main memory of the processor core, the one or more outgoing values being associated with an outgoing process of a context switch; and write one or more incoming values of non-functional data to the one or more non-functional registers, the one or more incoming values being associated with an incoming process of the context switch. The processor core may be configured to write at least one of the incoming values of nonfunctional data over at least one of the outgoing values of non-functional data in the one or more nonfunctional registers. At least one of the one or more incoming values of non-functional data may comprise at least one timing value and the one or more non-functional registers comprise one or more timing registers. The at least one timing value may be based on a number of clock cycles. At least one of the one or more incoming values of non-functional data may comprise at least one performance metric value and the one or more non-functional registers comprises one or more performance counter registers. The at least one performance metric value may comprise a number of cache hits, a number of cache misses, or a number of retired instructions. Optional features may be combined in various ways, in accordance with the disclosure.

[0016] Some implementations described herein relate to a method of manufacturing a processor core. The method comprises providing one or more functional data registers for storing a context of a process under execution; providing one or more non-functional registers for storing non-functional data of the processor core; and configuring the processor core to modify at least one of the one or more nonfunctional registers to include data that is independent of system measurements of the processor core.

[0017] Optional features of the processor core may be provided in some implementations of the method of manufacture.BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Fig. 1 is a schematic diagram of a typical microprocessor suitable for executing processes;

[0019] Fig. 2 is a schematic diagram illustrating a context switch where the microprocessor stops executing a process and starts executing another process;

[0020] Fig. 3 is a schematic diagram of a series of cache entries to illustrate how the microprocessor may be vulnerable to a shared resource side-channel attack;

[0021] Fig. 4 is a schematic diagram illustrating an approach by which the microprocessor may resolve a cache miss;

[0022] Fig. 5 is a schematic diagram of an example microprocessor in accordance with implementations described herein;

[0023] Fig. 6 is a schematic diagram illustrating a context switch where the example microprocessor stops executing a process and starts executing another process;

[0024] Fig. 7 is a schematic diagram illustrating an approach by which the example microprocessor may resolve a cache miss;

[0025] Fig. 8 is a schematic diagram illustrating how the example microprocessor is secure against a shared resource side-channel attack;

[0026] Fig. 9 is a table listing examples of commercially available microprocessors and their timing registers;

[0027] Fig. 10 is a schematic diagram illustrating timing and performance counter isolation in accordance with the implementations described herein;

[0028] Fig. 11 is a flow chart showing a method of manufacturing a microprocessor in accordance with the implementations described herein;

[0029] Fig. 12A is a graph illustrating access times of different cache lines for a commercially available microprocessor;

[0030] Fig. 12B is a graph illustrating access times of different cache lines for a microprocessor in accordance with implementations described herein;

[0031] Fig. 13A is a graph illustrating multiple access times of a defined size array (10 bytes) for a commercially available microprocessor;

[0032] Fig. 13B is a graph illustrating multiple access times of a defined size array (10 bytes) for a microprocessor in accordance with implementations described herein;

[0033] Fig. 14A is a graph illustrating multiple access times of a defined size array (1000 bytes) for a commercially available microprocessor;

[0034] Fig. 14B is a graph illustrating multiple access times of a defined size array (1000 bytes) for a microprocessor in accordance with implementations described herein;

[0035] Fig. 15A is a graph illustrating multiple access times of a defined size array (100000 bytes) for a commercially available microprocessor; and

[0036] Fig. 15B is a graph illustrating multiple access times of a defined size array (100000 bytes) for a microprocessor in accordance with implementations described herein.DETAILED DESCRIPTION

[0037] The following detailed description of example implementations refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements.

[0038] In the computing industry, there is a need to provide components that deliver high performance, with faster processing speeds being a significant driving force in the design of microprocessors. In recent years, this has led to the development of various techniques for increasing performance. For example, modem central processing units (CPUs) utilize advanced architectural features to enhance performance,such as speculative execution, out-of-order execution, branch prediction, hardware performance counters, and hierarchies of shared memories and buffers.

[0039] While these techniques improve performance, they also expose processors to microarchitectural side-channel attacks. The general approach of such attacks is to exploit information stored in the shared resources such as memories and buffers of a processor in order to infer secret data of another process. A program comprises a set of one or more instructions, each of which are to be executed on the microprocessor in order to run a process. A process is the run time instantiation and execution of a program. In the context of microarchitectural side channel attacks, one process may be associated with a malicious program and another process may be associated with a victim program whose secret data is leaked.

[0040] A typical microprocessor 100 that is vulnerable to microarchitectural side-channel attacks is shown in Fig.l. The microprocessor 100 comprises an arithmetic logic unit 102, a control unit 104 and a register file 106, and employs a cache 108 and main memory 110. The microprocessor 100 is communicatively coupled with the cache 108 and main memory 110, either directly or indirectly. Each of the cache 108 and main memory 110 may be part of the microprocessor (not shown) or may be part of an external device (as shown). The arrangement shown is just an example, and other arrangements are also suitable. For example, in some examples of typical microprocessors, the main memory may be accessible to the microprocessor via the cache. Note that the main memory 110 includes a first portion 114 and a second portion 116 which will be referred to below.

[0041] In order for the microprocessor 100 to execute a process, data relating to the process is loaded into the register file 106. This data relates to the functioning of the process and is called the context of the process. Thus, the context of a process is data provided by the process to the microprocessor in order to enable the microprocessor to execute the process. For example, in order to execute a first process (process 1), the microprocessor 100 may receive the context of the first process and save the context in one or more functional data registers 112 of the register file 106. When the context of the process is saved in the one or more functional data registers 112, the microprocessor is able to execute the process for the user.

[0042] Microprocessors generally execute processes one at a time and switch between executing different processes in order to implement various high performance execution techniques. For example, as shown in Fig. 2, the microprocessor 100 may perform a context switch between a first process (process 1) and a second process (process 2) in order to execute them both efficiently. A context switch is thus a mechanism by which a microprocessor stops executing a process and starts executing another process. It involves updating the context saved in the functional data register 112 to that of the incoming process. For example, when the microprocessor 100 performs a context switch from process 1 to process 2, it transmits the context of process 1 from its one or more functional data registers 112 to be stored in the first portion 114 of the main memory 110, and receives the context of process 2 and saves it in the one or more functional data registers 112.

[0043] When the microprocessor 100 saves the context of process 2 in the one or more functional data registers 112, it may overwrite at least some of the context of process 1. This is the purpose of saving thecontext of process 1 to the first portion 114 of the main memory 110, so that it is available when the microprocessor is ready to perform another context switch back to executing process 1.

[0044] This microprocessor 100 is, however, vulnerable to a shared resource side-channel attack. The shared resource being exploited may for example comprise a shared memory, a shared buffer, or a shared cache. Referring to Fig. 3, an example of a microarchitectural side-channel attack is shown. This example attack takes a prime and probe approach, in which a malicious process first primes the cache by filling it with data. When the microprocessor subsequently executes a victim process, the microprocessor evicts some of the malicious process’s data from the cache to make space for the victim process’s data in the cache. When execution of the malicious process is resumed, it makes requests for the data it previously saved in the cache and observes the timing behavior of the microprocessor 100 to establish where the victim process’s data was stored in the cache. Determining where the victim’s data was stored forms the basis of the data leakage exploited by the malicious process to gain access to the victim process’s secret data.

[0045] For example, when the microprocessor 100 is executing a malicious process, the malicious process may instruct the microprocessor 100 to fill the cache 108 with malicious process data in a priming stage of an attack. After a context switch, the microprocessor 100 executes a victim process which instructs the microprocessor 100 to save some of its data in the cache 108, for example at locations 300 and 302 shown in Fig. 3. Later, when the microprocessor is executing the malicious process, the malicious process makes a series of requests for the data items it previously saved to the cache. The malicious process observes the microprocessor’s timing behavior while retrieving the data items. Data items that are still saved in the cache result in a cache hit and can be identified because they are retrieved quickly. Data items that have been replaced by the victim process’s data result in a cache miss 304, which takes time for the microprocessor 100 to resolve by retrieving the data items from the main memory 110 and restoring them to the cache 108. By utilizing a mapping of its previously saved data items to locations in the cache and observing how long it takes the microprocessor to retrieve each data item, the malicious process can identify the locations of cache misses and therefore where in the cache the victim process stored its data.

[0046] Referring to Fig. 4, when a cache miss occurs the execution of the running process is stopped and microarchitectural and architectural components of the microprocessor 100 (for example a memory management unit (MMU) and / or a cache controller) resolve the cache miss by accessing the main memory 110 and loading the missing data into the cache 108 or the register file 106.

[0047] However, such cache miss resolution mechanisms may be fully managed by hardware components or jointly managed by the hardware components and the operating system. In all cases such cache miss resolution mechanisms are completely transparent to the stopped process and other processes in execution. During the course of the normal operation of the microprocessor, the microprocessor makes system measurements of events relevant to the microprocessor as a whole. For example, the microprocessor may measure various system parameters relating to time keeping (e.g. based on a number of clock cycles of the microprocessor), number of cache hits, number of cache misses, and number of retired instructions. These system measurements thus relate to the performance of the microprocessor as asystem and the microprocessor keeps track of them by recording them in non-functional registers. The data in the non-functional registers may be referred to as non-functional data. Since the non-functional registers may be visible to processes being executed on the microprocessor, processes are able to observe information such as timing information. By observing the time required to access a data item stored in the cache, the attacker process can infer if the data item was already in the cache or if the data item needed to be loaded from the main memory: in the former case (cache hit) the access time is short; in the latter case (cache miss) the time is longer. This enables the malicious process to detect cache misses, and thereby infer where in the cache the victim process’s data is stored.

[0048] This is just one way in which typical microprocessors are vulnerable to shared resource sidechannel attacks. The shared resource need not be a cache such as the cache 108, but may be any other shared storage resource such as memory or buffer utilized by the microprocessor when executing processes. Furthermore, in other microarchitectural side-channel attacks, a malicious process might not necessarily observe the microprocessor’s timing information, but may additionally or alternatively observe other system measurements recorded in the non-functional registers of the microprocessor. For example, other system measurements of the microprocessor may include performance counters such as the number of cache hits and / or misses or the number of retired instructions. There is a growing number of variations of microarchitectural side-channel attacks based on observing various microprocessor system measurements which are highly effective.

[0049] When considering the threat of microarchitectural side-channel attacks, the inventors have appreciated that these attacks are based on the microarchitecture of the microprocessor and that a security countermeasure is required that effectively changes these microarchitectural mechanisms without impacting negatively on performance, power consumption, silicon area usage and application software complexity. The inventors have appreciated that microarchitectural side-channel attacks rely on exploiting visibility of system measurements that are recorded in the non-functional registers of the microprocessor. In order to provide a solution, they have developed a new concept of how the nonfunctional registers of a microprocessor are used, in a significant departure from the typical functioning of modem microprocessors.

[0050] Referring to Fig. 5, an example microprocessor 500 in accordance with implementations described herein is shown. The microprocessor 500 comprises an arithmetic logic unit 502, a control unit 504 and a register file 506, and employs a cache 508 and main memory 510. The microprocessor 500 is communicatively coupled with the cache 508 and main memory 510, either directly or indirectly. Each of the cache 508 and main memory 510 may be part of the microprocessor (not shown) or may be part of an external device (as shown). The arrangement shown is just an example, and other arrangements are also possible. For example, in some example microprocessors in accordance with the present disclosure, the main memory may be accessible to the microprocessor via the cache.

[0051] The register file 506 comprises one or more functional data registers 512 and one or more nonfunctional registers 514. The functional data registers 512 are configured to store the context of a process to be executed.The non-functional registers 514 are configured to store system measurements of the microprocessor 500, such as for example time keeping measurements, number of cache hits, and number of retired instructions.

[0052] In accordance with implementations described herein, at least one of the one or more nonfunctional registers 514 can be modified by the microprocessor to include data that is independent of real system measurements of the processor core. Typically, the non-functional registers of a microprocessor are only updatable by hardware of the microprocessor that is configured to update system measurements to the non-functional registers. In accordance with implementations described herein, the non-functional registers 514 may be updated to include data that is independent of real system measurements, in a significant departure from typical microprocessors. This updatability enables the microprocessor to create a boundary between the true system measurements of the microprocessor (such as, for example, the clock cycle or the number of cache misses) and the non-functional data that running processes can observe in the non-functional registers. This decouples observable data in the non-functional registers from true system measurements of the microprocessor. The true system measurements can thus be made invisible to processes being executed by the microprocessor. The ability of the microprocessor to modify at least one of the one or more non-functional registers 514 may also be used to allow the at least one of the one or more the non-functional registers 514 to be accessed for read and write operations by a process having a suitable privilege level, such as a privilege level equal to or greater than a predetermined minimum privilege level. A process having a suitable privilege level may, for example, be an operating system. Allowing a process with a suitable privilege level read and write access to the at least one of the one or more non-functional registers enables the microprocessor to change the non-functional data when there is a context switch. In this case, the non-functional registers 514 no longer keep track of global microprocessor measurements as would be the case for a typical microprocessor, but rather they isolate non-functional data between each process running in the system. In this approach, the content of the nonfunctional registers is effectively included in the context of a running process.

[0053] For example, a context switch performed by the microprocessor 500 is shown in Fig. 6. In the example microprocessor 500, the non-functional registers 514 include at least one timing register. In order to stop executing a process 1 and start executing a process 2, the microprocessor 500 performs a context switch by transmitting (1) the context of process 1 from the functional data registers 512 and (2) the non-functional data from the non-functional registers 514 to a first portion 516 of the main memory 510. In this example, the non-functional data includes at least one timing value. When the at least one timing value is saved to the first portion 516 of the main memory 510, the timing keeping of process 1 is effectively frozen. The copies of the context of process 1 and of the non-functional data of process 1 that are stored in the portion 516 of the main memory 510 are used to resume the execution of process 1 at some point in the future and thus to implement a context switch. Thereafter, a context of process 2 and non-functional data including a timing value are loaded from a portion 518 of the main memory 510 into the one or more functional data registers 512 and the one or more non-functional registers 514, respectively. Each process thus has non-functional data such as, for example, timing information included in its context, and this is loaded into the register file 506 as part of an expanded context for themicroprocessor 500 to execute the process. This prevents one process from accessing non-functional data relating to the execution of other processes, thereby preventing side channel attacks based on the nonfunctional data.

[0054] Referring to Fig. 7, when a cache miss occurs the execution of the running process is stopped and microarchitectural and architectural components of the microprocessor 500 (for example an MMU and / or a cache controller) resolve the cache miss by accessing the main memory 510 and loading the missing data into the cache 508 or the register file 512.

[0055] In the example microprocessor 500, the timing register is incremented by a predetermined or random value, and not by the real execution time, while the microprocessor 500 retrieves the missing data and reloads it into the cache. Thus, in this example implementation a predetermined or random duration, independent from the real duration, is assigned to every instruction implemented by the processor, and this duration is added to the non-functional register when executing each respective instruction. This makes the true timing of the execution of a process invisible to the process itself, and only the predetermined or random duration added to the non-functional registers is observable by the running process.

[0056] Referring to Fig. 8, if process 1 is a malicious program, it is therefore unable to observe the real time for retrieving missing data, and cannot detect a cache miss. This secures microprocessor 500 against microarchitectural side-channel attacks that rely on observing timing behavior of the microprocessor.

[0057] In accordance with implementations described herein, the contents of the non-functional registers do not necessarily include timing values. The non-functional data in the non-functional registers may additionally or alternatively include performance metric values such as, for example, numbers of cache hits and / or misses or numbers of retired instructions. By updating predetermined performance metric values to non-functional registers, performance metrics may be standardized so that running processes cannot observe the true metrics of the system, but instead observe only a standardized or idealized set of metrics. This helps secure microprocessors against a wide range of microarchitectural side-channel attacks by effectively removing the side channels that could otherwise be exploited to obtain information about executions of other processes.

[0058] By modifying non-functional registers to include data that is independent of real system measurements, a microprocessor may, for example:• Standardize timing updated to the non-functional registers so that a process can only observe standardized timings, such as, for example, a time of zero for loading a data from main memory to cache or register fde;• Standardise performance metrics updated to the non-functional registers so thata process can, for example, not observe a total number of cache misses of the microprocessor;• Load into the non-functional registers non-functional data of an incoming process during a context switch so that the context of a process is effectively extended to include non-functional data and each process can observe only its own non-functional data.

[0059] Thus, it is by removing the dependence of the content of the non-functional registers on real system measurements that the microprocessor may be secured against a wide range of microarchitectural side-channel attacks.

[0060] Referring to Fig.9, examples of commercially available microprocessors 902 and their timing registers 904 are shown in a table. These commercially available microprocessors are the Intel x86-64 Pentium J5505, the ARM Cortex-A Cortex-A53, and the RISC-V RV64 SiFive U540. They may be modified in accordance with the present disclosure so that they can modify their non-functional registers to include data that is independent of their real system measurements. For example, they may be modified to update data to their timing registers (or timing counters) 904 that are independent of their real system measurements of time. For each microprocessor, the table shows an instruction 906 for accessing its timing register and the frequency 908 of its clock.

[0061] Referring to the example shown in Fig. 10, by transmitting non-functional data of an outgoing process in a context switch so that it can be saved and by loading non-functional data of an incoming process into the non-functional registers, a microprocessor in accordance with the present disclosure may ensure that each process can only observe its own non-functional data, and cannot observe non-functional data of another process. This creates isolation of non-functional data such as timing values and performance metric values between processes. For example, this approach can be used to create isolation of timing values (time perception) and performance metric values (counter instances) among processes 1002 belonging to the same operating system and isolation of timing and performance metric values among operating systems 1004 belonging to the same system on a chip (shown) or hypervisor (not shown) in the case of a virtualized system.

[0062] Referring to Fig. 11, a method 1100 of manufacturing a microprocessor in accordance with the present disclosure is shown. The method comprises: providing 1102 one or more functional data registers for storing a context of a process under execution; providing 1104 one or more non-functional registers for storing non-functional data of the processor core; and configuring 1106 the processor core to modify at least one of the one or more non-functional registers to include data that is independent of system measurements of the processor core. Other features of example implementations of microprocessors described herein may optionally be provided.

[0063] It has been demonstrated experimentally that microprocessors in accordance with implementations described herein are capable of neutralizing a wide range of microarchitectural sidechannel attacks.

[0064] For example, microprocessors that standardize perceived timing for instructions executed at user privilege level may be configured to add a predetermined timing value for every instruction to a timing register, regardless of how long they take to execute and whether they involve a cache miss.

[0065] Referring to Fig. 12A, access times of different cache lines are shown for a commercially available microprocessor, VexRiscv. The access times vary with most taking values of approximately 27 cycles. The access times for some lines are significantly higher, around 80 cycles. These higher access times indicate cache misses, enabling a malicious process to launch a successful timing side-channel attack that could leak sensitive information. By contrast, access times are constant for the different cachelines in a microprocessor that standardizes perceived timing for memory access instructions, as shown in Fig. 12B. A timing attack is therefore unable to distinguish between cache hits and cache misses, and the timing attack is unsuccessful. Microprocessors that standardize perceived timing are therefore highly effective at neutralizing a timing -based side-channel attack.

[0066] Referring to Fig. 13A, the total access time for accessing all elements of a 10 byte array in a memory is plotted for 200 accesses to the memory. For example, the access time for accessing all elements is plotted for the first time the memory is accessed, followed by the second time the memory is accessed, and so on. The spikes in the access time represent context switch processes or interrupts appearing during access of the array. These spikes demonstrate that a timing side channel is present in this commercially available microprocessor. By contrast, there are no spikes in the graph of Fig. 13B, showing that the side channel is not present in microprocessors implementing security mechanisms disclosed herein.

[0067] Figs. 14A and 14B correspond to Figs. 13A and 13B, but for a 1000 byte array in a memory. Similar spikes in Fig. 14A show the presence of a side channel in the commercially available microprocessor, while the absence of spikes shows that the side channel is not present in implementations described herein.

[0068] Fig. 15A and 15B also correspond to Figs. 13A and 13B, but for a much larger array of 100,000 bytes. Here, we see the same effects due to context switches and interrupts for the commercially available microprocessor but additionally this larger memory is subject to increased access times resulting from cache misses. This increases the baseline of the access times to 0.75e7cycles. By contrast, the access times for the microprocessor in accordance with the present disclosure do not increase and do not have spikes, thereby removing the side channel, as shown in Fig. 15B.

[0069] In the three examples of Figs. 13B, 14, B, and 15B we can appreciate how, even in separate execution runs to access a memory, the time measured in the processor implementing presently disclosed techniques is substantially constant.

[0070] Microprocessors in accordance with the implementations described herein provide security benefits in a way that is highly advantageous. By modifying non-fiinctional registers to include data that is independent of system managements, implementations described herein are highly effective at neutralizing microarchitectural side-channel attacks in a way that: requires only a limited modification of the processor microarchitecture; is compatible with any instruction set architecture (ISA); has a negligible impact on power consumption or silicon area occupation; does not have a detrimental impact on performance; and requires only a limited modification of the overlaying operating system.

[0071] The foregoing disclosure provides illustration and description, but is not intended to be exhaustive or to limit the implementations to the precise forms disclosed. Modifications and variations may be made in light of the above disclosure or may be acquired from practice of the implementations.

[0072] As used herein, the term “component” is intended to be broadly construed as hardware, firmware, or a combination of hardware and software. It will be apparent that systems and / or methods described herein may be implemented in different forms of hardware, firmware, and / or a combination of hardware and software. The actual specialized control hardware or software code used to implementthese systems and / or methods is not limiting of the implementations. Thus, the operation and behavior of the systems and / or methods are described herein without reference to specific software code - it being understood that software and hardware can be used to implement the systems and / or methods based on the description herein.

[0073] Even though particular combinations of features are recited in the claims and / or disclosed in the specification, these combinations are not intended to limit the disclosure of various implementations. In fact, many of these features may be combined in ways not specifically recited in the claims and / or disclosed in the specification. Although each dependent claim listed below may directly depend on only one claim, the disclosure of various implementations includes each dependent claim in combination with every other claim in the claim set. As used herein, a phrase referring to “at least one of’ a list of items refers to any combination of those items, including single members. As an example, “at least one of: a, b, or c” is intended to cover a, b, c, a-b, a-c, b-c, and a-b-c, as well as any combination with multiple of the same item.

[0074] No element, act, or instruction used herein should be construed as critical or essential unless explicitly described as such. Also, as used herein, the articles “a” and “an” are intended to include one or more items, and may be used interchangeably with “one or more.” Further, as used herein, the article “the” is intended to include one or more items referenced in connection with the article “the” and may be used interchangeably with “the one or more.” Furthermore, as used herein, the term “set” is intended to include one or more items (e.g., related items, unrelated items, or a combination of related and unrelated items), and may be used interchangeably with “one or more.” Where only one item is intended, the phrase “only one” or similar language is used. Also, as used herein, the terms “has,” “have,” “having,” or the like are intended to be open-ended terms. Further, the phrase “based on” is intended to mean “based, at least in part, on” unless explicitly stated otherwise. Also, as used herein, the term “or” is intended to be inclusive when used in a series and may be used interchangeably with “and / or,” unless explicitly stated otherwise (e.g., if used in combination with “either” or “only one of’).

[0075] A computer readable medium may include non-transitory type media such as physical storage media including storage discs and solid state devices. A computer readable medium may also or alternatively include transient media such as carrier signals and transmission media. A computer- readable storage medium is defined herein as a non-transitory memory device. A memory device includes memory space within a single physical storage device or memory space spread across multiple physical storage devices.

[0076] Thus, from one perspective, there has now been described a processor core for executing processes. The processor core comprises: one or more functional data registers for storing a context of a process under execution; and one or more non-functional registers for storing non-fimctional data. The processor core is configured to modify at least one of the one or more non-fimctional registers to include data that is independent of system measurements of the processor core.

[0077] Further examples of feature combinations taught by the present disclosure are set out in the following numbered clauses:1. A processor core for executing processes, the processor core comprising: one or more functional data registers for storing a context of a process under execution; and one or more non-functional registers for storing non-functional data; wherein the processor core is configured to modify at least one of the one or more non-functional registers to include data that is independent of system measurements of the processor core.2. A processor core of clause 1, wherein the system measurements of the processor core comprise measurements of time and, additionally or alternatively, measurements of one or more performance metrics.3. The processor core of clause 1 or 2, wherein the processor core is configured to modify the at least one of the one or more non-functional registers by adding one or more predetermined or random values of non-functional data to the one or more non-functional registers during execution of a process.4. The processor core of clause 3, wherein each of the one or more predetermined values is assigned based on an instruction under execution, the instruction being part of the process.5. The processor core of clause 3 or 4, wherein the one or more non-functional registers comprise one or more timing registers and at least one of the one or more values of non-functional data comprise at least one timing value.6. The processor core of clause 5, wherein the at least one timing value is based on a number of clock cycles.7. The processor core of clause 5 or 6, wherein the processor core is configured to increment one or more of the timing registers by a pre-determined timing value in response to executing aninstruction irrespective of how long it takes the processor core to execute the instruction, the instruction being part of the process.8. The processor core of clause 7, wherein the pre -determined time value depends on whether the instruction comprises ‘ADD, ‘SUB, ‘LOAD, ‘STORE, ‘MUL, or ‘DIV.9. The processor core of any of clauses 5 to 8, wherein the processor core is configured to not increment the timing register in response to time elapsed for implementing a cache miss resolution mechanism.10. The processor core of any of clauses 5 to 9, wherein the processor core is configured to increment the timing register by a random or predetermined timing value in response to executing a memory access instruction irrespective of how long it takes the processor core to execute the memory access instruction.11. The processor core of any of clauses 3 to 10, wherein the one or more non-functional registers comprise a performance counter register and at least one of the one or more values of non-functional data comprises a performance metric value.12. The processor core of clause 11, wherein the performance metric value comprises a number of cache hits, a number of cache misses, or a number of retired instructions.13. The processor core of clause 11 or 12, wherein the processor core is configured to increment one or more of the performance counter registers by a pre -determined performance metric value in response to executing an instruction irrespective of a true performance metric of the processor core during the execution of the instruction, the instruction being part of the process.14. The processor core of any preceding clause, wherein the processor core is configured to modify the at least one of the one or more non-fimctional registers by allowing the at least one of the one or more non-fimctional registers to be accessed for read and write operations by a process with a predefined privilege level, to thereby include non-fimctional data in the context of the process under execution.15. The processor core of any preceding clause, wherein the processor core is configured to: cause one or more outgoing values of non-fimctional data from the one or more non-fimctional registers to be saved in a main memory of the processor core, the one or more outgoing values being associated with an outgoing process of a context switch; and write one or more incoming values of non-fimctional data to the one or more non-fimctional registers, the one or more incoming values being associated with an incoming process of the context switch.16. The processor core of clause 15, wherein the processor core is configured to write at least one of the incoming values of non-fimctional data over at least one of the outgoing values of nonfunctional data in the one or more non-fimctional registers.17. The processor core of clause 15 or 16, wherein at least one of the one or more incoming values of non-fimctional data comprises at least one timing value and the one or more non-fimctional registers comprise one or more timing registers.18. The processor core of clause 17, wherein the at least one timing value is based on a number of clock cycles.19. The processor core of any of clauses 14 to 18, wherein at least one of the one or more incoming values of non-fimctional data comprises at least one performance metric value and the one or more non-functional registers comprises one or more performance counter registers.20. The processor core of clause 17, wherein the at least one performance metric value comprises a number of cache hits, a number of cache misses, or a number of retired instructions.21. A method of manufacturing a processor core, the method comprising: providing one or more functional data registers for storing a context of a process under execution; providing one or more non-functional registers for storing non-functional data of the processor core; and configuring the processor core to modify at least one of the one or more non-functional registers to include data that is independent of system measurements of the processor core.

Claims

WHAT IS CLAIMED IS:

1. A processor core for executing processes, the processor core comprising: one or more functional data registers for storing a context of a process under execution; and one or more non-functional registers for storing non-functional data; wherein the processor core is configured to modify at least one of the one or more non-functional registers to include data that is independent of system measurements of the processor core.

2. A processor core of claim 1, wherein the system measurements of the processor core comprise measurements of time and, additionally or alternatively, measurements of one or more performance metrics.

3. The processor core of claim 1 or 2, wherein the processor core is configured to modify the at least one of the one or more non-functional registers by adding one or more predetermined or random values of non-functional data to the one or more non-functional registers during execution of a process.

4. The processor core of claim 3, wherein each of the one or more predetermined values is assigned based on an instruction under execution, the instruction being part of the process.

5. The processor core of claim 3 or 4, wherein the one or more non-functional registers comprise one or more timing registers and at least one of the one or more values of non-functional data comprise at least one timing value.

6. The processor core of claim 5, wherein the at least one timing value is based on a number of clock cycles.

7. The processor core of claim 5 or 6, wherein the processor core is configured to increment one or more of the timing registers by a pre -determined timing value in response to executing an instruction irrespective of how long it takes the processor core to execute the instruction, the instruction being part of the process.

8. The processor core of claim 7, wherein the pre-determined time value depends on whether the instruction comprises ‘ADD, ‘SUB, ‘LOAD, ‘STORE, ‘MUL, or ‘DIV.

9. The processor core of any of claims 5 to 8, wherein the processor core is configured to not increment the timing register in response to time elapsed for implementing a cache miss resolution mechanism.

10. The processor core of any of claims 5 to 9, wherein the processor core is configured to increment the timing register by a random or predetermined timing value in response to executing amemory access instruction irrespective of how long it takes the processor core to execute the memory access instruction.

11. The processor core of any of claims 3 to 10, wherein the one or more non-functional registers comprise a performance counter register and at least one of the one or more values of non-functional data comprises a performance metric value.

12. The processor core of claim 11, wherein the performance metric value comprises a number of cache hits, a number of cache misses, or a number of retired instructions.

13. The processor core of claim 11 or 12, wherein the processor core is configured to increment one or more of the performance counter registers by a pre -determined performance metric value in response to executing an instruction irrespective of a true performance metric of the processor core during the execution of the instruction, the instruction being part of the process.

14. The processor core of any preceding claim, wherein the processor core is configured to modify the at least one of the one or more non-functional registers by allowing the at least one of the one or more non-functional registers to be accessed for read and write operations by a process with a predefined privilege level, to thereby include non-functional data in the context of the process under execution.

15. The processor core of any preceding claim, wherein the processor core is configured to: cause one or more outgoing values of non-functional data from the one or more non-functional registers to be saved in a main memory of the processor core, the one or more outgoing values being associated with an outgoing process of a context switch; and write one or more incoming values of non-functional data to the one or more non-functional registers, the one or more incoming values being associated with an incoming process of the context switch.

16. The processor core of claim 15, wherein the processor core is configured to write at least one of the incoming values of non-functional data over at least one of the outgoing values of non-functional data in the one or more non-functional registers.

17. The processor core of claim 15 or 16, wherein at least one of the one or more incoming values of non-functional data comprises at least one timing value and the one or more non-functional registers comprise one or more timing registers.

18. The processor core of claim 17, wherein the at least one timing value is based on a number of clock cycles.

19. The processor core of any of claims 14 to 18, wherein at least one of the one or more incoming values of non-functional data comprises at least one performance metric value and the one or more nonfunctional registers comprises one or more performance counter registers.

20. The processor core of claim 17, wherein the at least one performance metric value comprises a number of cache hits, a number of cache misses, or a number of retired instructions.

21. A method of manufacturing a processor core, the method comprising: providing one or more functional data registers for storing a context of a process under execution; providing one or more non-functional registers for storing non-functional data of the processor core; and configuring the processor core to modify at least one of the one or more non-functional registers to include data that is independent of system measurements of the processor core.

Images