Dynamic Sensitive Instruction Execution Constraints
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing processor technologies face challenges in preventing side-channel attacks, such as Portsmash, which exploit timing information to discover sensitive instructions being executed, compromising security without significantly impacting performance.
Innovation Solution
The implementation of dynamic designation of instructions as sensitive, where a sensitive handling enable indicator is used to invoke constraints for execution, ensuring that only instructions from the same thread can execute during sensitive instruction cycles, thereby preventing side-channel attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If multiple threads execute instructions in parallel using shared execution units, then processor productivity is improved, but side-channel attacks can exploit timing information to compromise security
Solution Approach 1:
The patent segments the execution units into dedicated execution units for each thread, isolating sensitive instruction execution to specific units. This segmentation prevents other threads from executing instructions simultaneously on the same execution unit, thereby eliminating the timing information leakage that enables side-channel attacks while preserving parallel processing capabilities across multiple threads
Solution Approach 2:
The patent applies local quality by making execution units have different properties - some execution units are designated as sensitive and restricted to executing only sensitive instructions from a single thread, while other execution units can execute non-sensitive instructions. This differential property assignment allows security constraints to be applied locally only where needed, maintaining overall system performance
2Reliability
If sensitive instructions are executed with constrained execution units, then security against side-channel attacks is improved, but processor complexity increases
Solution Approach 1:
The patent implements dynamics by allowing the processor to dynamically identify and constrain sensitive instructions based on thread state and execution context. The system can adaptively assign execution units to threads based on whether they are executing sensitive instructions, enabling flexible security management without requiring static architectural complexity
Solution Approach 2:
The patent introduces an intermediary mechanism - a thread state register or similar control structure - that mediates between the security requirements and the execution units. This intermediary tracks which threads are executing sensitive instructions and coordinates the allocation of execution units, simplifying the overall architecture by centralizing the control logic
Data Source
AI summary
Described herein are systems and methods for dynamic designation of instructions as sensitive. For example, some methods include detecting that a first instruction of a first process has been designated as a sensitive instruction; checking whether a sensitive handling enable indicator in a process state register storing a state of the first process is enabled; responsive to detection of the sensitive instruction and enablement of the sensitive handling enable indicator, invoking a constraint for execution of the first instruction; executing the first instruction subject to the constraint; and executing a second instruction of the first process without the constraint.