Processor Event-Notify Mode for Side-Channel Attack Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies are vulnerable to side-channel attacks, which exploit shared resources like CPUs to infer secret information from memory access patterns or cache behavior.
Innovation Solution
The implementation of a set of instructions and hardware support that enables a processor to operate in a side-channel protected mode, known as event-notify mode, which redirects user-level program execution through a user-level event handler to prevent attackers from observing cache or memory access patterns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If a processor operates in standard mode allowing shared cache resources, then processing speed and resource utilization are improved, but vulnerability to side-channel attacks increases
Solution Approach 1:
The patent segments the processor operation into two distinct modes: standard mode for normal high-speed processing and event-notify mode for protected operation. This segmentation allows the system to switch between performance optimization and security protection based on operational requirements, effectively resolving the contradiction between speed and security vulnerability
Solution Approach 2:
The patent implements preliminary action by pre-loading critical data into cache before executing security-sensitive operations and by setting up event notification handlers in advance. This proactive approach ensures that cache contents are controlled and monitored before potential side-channel attacks can exploit them, maintaining both speed and security
2Reliability
If critical data is pinned in cache to prevent eviction, then resistance to cache-based attacks is improved, but cache memory usage increases
Solution Approach 1:
The patent applies dynamics by making cache pinning selective and temporary rather than static and permanent. Critical data is pinned in cache only during event-notify mode operations and only for the duration necessary to prevent eviction, allowing the cache to be dynamically allocated and released based on security requirements, thus balancing reliability and memory usage
3Reliability
If event-notify mode is activated to protect against attacks, then security against side-channel attacks is improved, but program execution overhead increases
Solution Approach 1:
The patent applies local quality by activating event-notify mode protection only for specific security-sensitive operations rather than for the entire program execution. This localized approach ensures that security protection is applied precisely where needed, minimizing the overhead impact on overall program execution while maintaining necessary security guarantees
Data Source
Figure 1
Figure 2A~2B
Figure 3A~3D
AI summary
Detailed herein are systems, apparatuses, and methods for a computer architecture with instruction set support to mitigate against page fault and/or cache-based side-channel attacks. In an embodiment, a processor includes a decoder to decode an instruction into a decoded instruction, the instruction comprising a first field that indicates an instruction pointer to a user-level event handler; and an execution unit to execute the decoded instruction to, after a swap of an instruction pointer that indicates where an event occurred from a current instruction pointer register into a user-level event handler pointer register, push the instruction pointer that indicates where the event occurred onto call stack storage, and change a current instruction pointer in the current instruction pointer register to the instruction pointer to the user-level event handler.