Indirect Branch Predictor Encryption Against Malicious Table Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern branch predictors in computing systems are susceptible to malicious attacks that manipulate branch prediction information, leading to unauthorized access to sensitive data, and existing methods fail to efficiently protect this information.
Innovation Solution
Implementing a branch predictor that stores branch target addresses along with security tags containing machine context components, such as exception levels and process identifiers, to authenticate and validate branch predictions, and encrypting these tags and addresses to prevent unauthorized updates.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If branch prediction information is stored in a table for performance improvement, then instruction execution speed is improved, but the system becomes susceptible to malicious attacks and security breaches
Solution Approach 1:
A security tag is introduced as an intermediary element between the branch target address and the branch prediction table. This security tag contains authentication information that verifies the legitimacy of branch target addresses before they are used for prediction, thereby preventing malicious attacks while maintaining the performance benefits of branch prediction
Solution Approach 2:
Security tags are pre-computed and stored alongside branch target addresses in the branch prediction table before any prediction occurs. This preliminary authentication mechanism ensures that only legitimate branch targets can be used, preventing security breaches while maintaining fast prediction performance
2Reliability
If security tags are added to protect branch prediction tables, then security reliability is improved, but device complexity increases
Solution Approach 1:
The security tag is merged with the existing branch prediction table structure, combining authentication data with branch target addresses in a unified table format. This integration approach minimizes additional hardware complexity while providing comprehensive security protection
3Reliability
If branch target addresses are encrypted to prevent unauthorized access, then security reliability is improved, but access time increases
Solution Approach 1:
Branch target addresses and their corresponding security tags are pre-encrypted and stored together in the branch prediction table. This preliminary encryption eliminates the need for real-time encryption/decryption operations during prediction, maintaining fast access times while ensuring security
Data Source
AI summary
A system and method for efficiently protecting branch prediction information. In various embodiments, a computing system includes at least one processor with a branch predictor storing branch target addresses and security tags in a table. The security tag includes one or more components of machine context. When the branch predictor receives a portion of a first program counter of a first branch instruction, and hits on a first table entry during an access, the branch predictor reads out a first security tag. The branch predictor compares one or more components of machine context of the first security tag to one or more components of machine context of the first branch instruction. When there is at least one mismatch, the branch prediction information of the first table entry is not used. Additionally, there is no updating of any branch prediction training information of the first table entry.