Separate Branch Target Buffers for Speculative Execution Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems face security vulnerabilities due to speculative execution, particularly in branch predictions, which can lead to attacks like Meltdown and Spectre.
Innovation Solution
The use of separate branch target buffers for different levels of call routines, combined with a shadow cache to isolate speculative execution effects, and the incorporation of static object identification numbers in memory addresses to secure conditional speculative instruction execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If speculative execution is used to improve processor performance, then execution speed is improved, but security vulnerabilities are introduced
Solution Approach 1:
The patent divides the branch target buffer into multiple separate buffers, with each buffer dedicated to a specific call level. This segmentation prevents cross-level contamination of branch prediction data, allowing speculative execution to proceed securely at each level without exposing vulnerabilities to other levels.
Solution Approach 2:
The patent introduces call level identification numbers as an intermediary mechanism that mediates access to branch target buffers. Each buffer is associated with a specific call level ID, and the processor uses these IDs to ensure that speculative execution at one level cannot access or corrupt branch prediction data from other levels, thus preventing security vulnerabilities while maintaining execution speed.
2Device complexity
If a single branch target buffer is used for all call levels, then device complexity is reduced, but security against branch target injection attacks is compromised
Solution Approach 1:
The patent segments the single branch target buffer into multiple separate buffers, each dedicated to a specific call level. This segmentation increases device complexity slightly but provides the necessary isolation to prevent branch target injection attacks, where malicious code could otherwise inject fake branch targets into a shared buffer and redirect execution.
Solution Approach 2:
The patent applies local quality by giving each branch target buffer specialized characteristics specific to its call level. Each buffer is optimized for its specific level's branching patterns and is protected by call level identification, ensuring that security measures are applied locally where needed rather than requiring a completely different architecture.
3Quantity of substance
If branch target buffers are shared across different call levels, then memory usage is optimized, but speculative execution security is compromised
Solution Approach 1:
The patent segments the branch target buffer memory into multiple separate buffers, with each buffer allocated to a specific call level. This segmentation ensures that speculative execution at one call level cannot access or corrupt branch prediction data from other levels, maintaining security while still providing efficient memory utilization for each level's specific needs.
Solution Approach 2:
The patent uses call level identification numbers as intermediaries that control access to branch target buffer memory. Each buffer is associated with a specific call level ID, and the processor uses these IDs to mediate access, ensuring that speculative execution security is maintained while memory is used efficiently for each level's branch prediction requirements.
Data Source
AI summary
A computing device (e.g., a processor) having a plurality of branch target buffers. A first branch target buffer in the plurality of branch target buffers is used in execution of a set of instructions containing a call to a subroutine. In response to the call to the subroutine, a second branch target buffer is allocated from the plurality of branch target buffers for execution of instructions in the subroutine. The second branch target buffer is cleared before the execution of the instructions in the subroutine. The execution of the instructions in the subroutine is restricted to access the second branch target buffer and blocked from accessing branch target buffers other than the second branch target buffer.