Secure Speculative Execution via Protected Data Tagging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Speculative execution in computer systems can compromise the security of protected data by allowing processors to perform illegal operations, such as reading protected data during speculative execution, which can be exploited by attackers to exfiltrate sensitive information.
Innovation Solution
A system and method that utilize a processor configured to identify protected data through tags in the storage, disallowing immediate successful completion of read instructions during speculative execution until the condition is determined, and using a special store instruction to mark sensitive data as protected, thereby preventing illegal operations and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If speculative execution is used to improve processor efficiency, then processing speed is improved, but security of protected data deteriorates
Solution Approach 1:
The patent introduces a security mechanism as an intermediary between the speculative execution unit and protected data in memory. This mechanism includes checking whether data is protected and whether the current execution is speculative, and blocking the data path accordingly. The intermediary prevents direct access to protected data during speculative execution, thus maintaining security while allowing speculative execution to proceed for non-protected data.
Solution Approach 2:
The patent applies preliminary anti-action by preemptively identifying protected data through tags before speculative execution attempts to access it. The system marks certain data as protected in advance and sets up detection mechanisms that activate before any potential security breach can occur. This prevents the harmful effect of unauthorized data access before it can happen during speculative execution.
2Productivity
If speculative execution allows reading protected data, then processing efficiency is improved, but illegal operations occur
Solution Approach 1:
A security checking mechanism acts as an intermediary between the speculative execution unit and protected data. This intermediary checks two conditions: whether the data is marked as protected and whether the current execution context is speculative. If both conditions are true, the data path is blocked, preventing illegal read operations while allowing legal operations to proceed uninterrupted.
Solution Approach 2:
The system performs preliminary actions by tagging protected data in advance and setting up detection mechanisms before speculative execution begins. The tags are attached to protected data during normal operation, and the detection mechanism is pre-configured to recognize these tags and block access during speculative execution, preventing illegal operations before they can occur.
Data Source
AI summary
A system including a computer storage and a processor is described. The computer storage is configured to identify a stored data as protected. The processor is configured to perform speculative execution. To perform the speculative execution, the processor is configured to determine, in response to the speculative execution of an instruction to read the stored data, whether the stored data is identified as protected. In response to a determination that the stored data attempted to be read during the speculative execution is protected, the processor is configured to disallow during the speculative execution immediate successful completion of the instruction to read the stored data.