Branch Prediction Encoding for Side Channel Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Side channel attacks exploit micro-architectural storage circuits to access and infer information across different execution environments in data processing systems, compromising security by allowing unauthorized access to sensitive data.
Innovation Solution
Implementing encoding circuitry that encodes input bits based on the current execution environment, making it difficult for one environment to infer information about another's address space, and using encryption to protect branch prediction structures from false positive hits.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If micro-architectural storage circuits are shared across execution environments to improve performance, then productivity increases, but security deteriorates due to side channel attacks enabling unauthorized access to sensitive data
Solution Approach 1:
The patent segments the address space of different execution environments by applying context-specific encoding to address bits. Each execution environment's addresses are encoded with unique bits identifying that environment, creating segmented address spaces that prevent cross-environment inference while maintaining shared storage circuitry.
Solution Approach 2:
The patent changes the parameter representation of addresses by encoding selected bits based on the current execution context. The encoding transforms physical address bits into context-dependent encoded bits, altering how addresses are represented in storage circuits without changing the underlying physical storage structure.
2Object-affected harmful factors
If encoding circuitry is implemented to obfuscate data location between execution environments, then security improves, but device complexity increases due to additional encoding steps
Solution Approach 1:
The patent merges the encoding function with existing address generation logic in the execution environment. The encoding circuitry is integrated into the address path such that encoding is applied as part of the normal address generation process, avoiding separate dedicated encoding stages and reducing overall device complexity.
Solution Approach 2:
The patent introduces an intermediary encoding layer between the execution environment and storage circuits. This intermediary component translates addresses into context-encoded forms without requiring fundamental changes to either the execution environment or storage circuits, thereby limiting the increase in device complexity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A data processing apparatus comprises branch prediction circuitry adapted to store at least one branch prediction state entry in relation to a stream of instructions, input circuitry to receive at least one input to generate a new branch prediction state entry, wherein the at least one input comprises a plurality of bits; and coding circuitry adapted to perform an encoding operation to encode at least some of the plurality of bits based on a value associated with a current execution environment in which the stream of instructions is being executed. This guards against potential attacks which exploit the ability for branch prediction entries trained by one execution environment to be used by another execution environment as a basis for branch predictions.