Processor Event-Notify Mode for Side-Channel Attack Mitigation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing technologies are vulnerable to side-channel attacks, which exploit shared resources like CPUs to infer secret information from memory access patterns or cache behavior.

Innovation Solution

The implementation of a set of instructions and hardware support that enables a processor to operate in a side-channel protected mode, known as event-notify mode, which redirects user-level program execution through a user-level event handler to prevent attackers from observing cache or memory access patterns.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Speed

If a processor operates in standard mode allowing shared cache resources, then processing speed and resource utilization are improved, but vulnerability to side-channel attacks increases

Engineering Contradiction:
Improveprocessing speedVSAvoidside-channel attack vulnerability
Core Design Contradiction:
SpeedVSObject-affected harmful factors

Solution Approach 1:

The patent segments the processor operation into two distinct modes: standard mode for normal high-speed processing and event-notify mode for protected operation. This segmentation allows the system to switch between performance optimization and security protection based on operational requirements, effectively resolving the contradiction between speed and security vulnerability

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent implements preliminary action by pre-loading critical data into cache before executing security-sensitive operations and by setting up event notification handlers in advance. This proactive approach ensures that cache contents are controlled and monitored before potential side-channel attacks can exploit them, maintaining both speed and security

Inventive Principle:
Principle #10Preliminary action

2Reliability

If critical data is pinned in cache to prevent eviction, then resistance to cache-based attacks is improved, but cache memory usage increases

Engineering Contradiction:
Improveresistance to cache-based attacksVSAvoidcache memory usage
Core Design Contradiction:
ReliabilityVSQuantity of substance

Solution Approach 1:

The patent applies dynamics by making cache pinning selective and temporary rather than static and permanent. Critical data is pinned in cache only during event-notify mode operations and only for the duration necessary to prevent eviction, allowing the cache to be dynamically allocated and released based on security requirements, thus balancing reliability and memory usage

Inventive Principle:
Principle #15Dynamics

3Reliability

If event-notify mode is activated to protect against attacks, then security against side-channel attacks is improved, but program execution overhead increases

Engineering Contradiction:
Improvesecurity protectionVSAvoidprogram execution overhead
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent applies local quality by activating event-notify mode protection only for specific security-sensitive operations rather than for the entire program execution. This localized approach ensures that security protection is applied precisely where needed, minimizing the overhead impact on overall program execution while maintaining necessary security guarantees

Inventive Principle:
Principle #3Local quality

Data Source

PatentEP3757829B1Processor instruction support for mitigating controlled-channel and cache-based side-channel attacks
Publication Date: 2025.04.23 INTEL CORP
  • EP3757829B1 patent drawingFigure 1
  • EP3757829B1 patent drawingFigure 2A~2B
  • EP3757829B1 patent drawingFigure 3A~3D

AI summary

Detailed herein are systems, apparatuses, and methods for a computer architecture with instruction set support to mitigate against page fault and/or cache-based side-channel attacks. In an embodiment, a processor includes a decoder to decode an instruction into a decoded instruction, the instruction comprising a first field that indicates an instruction pointer to a user-level event handler; and an execution unit to execute the decoded instruction to, after a swap of an instruction pointer that indicates where an event occurred from a current instruction pointer register into a user-level event handler pointer register, push the instruction pointer that indicates where the event occurred onto call stack storage, and change a current instruction pointer in the current instruction pointer register to the instruction pointer to the user-level event handler.