Mobilizing the Micro-Ops: Exploiting Context Sensitive Decoding for Security and Energy Efficiency

Taram, Mohammadkazem; Venkat, Ashish; Tullsen, Dean M.

doi:10.1109/isca.2018.00058

Cited by 20 publications

(7 citation statements)

References 62 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Corliss, et al [18][19][20] propose dynamic instruction stream editing (DISE), a macro-engine that customizes the dynamic instruction stream at the decoder level, by pattern-matching userdefined production rules pushed into the decoder. Taram, et al [80] propose context-sensitive decoding that leverages the CISC to RISC translation feature of modern instruction set decoders to dynamically alter the behavior of programmervisible instructions without recompilation or binary translation [26,91]. While we leverage these approaches in this research, this work targets a different class of emerging attacks, and proposes several additional techniques beyond microcode customization.…”

Section: Background and Related Workmentioning

confidence: 99%

“…Again, Figure 3 gives the architectural overview of our defense strategy -context-sensitive fencing. The central piece of the proposed architecture is an x86 microcode engine that has context-sensitive decoding (CSD) capabilities [80], allowing it to optionally translate a native x86 instruction into a customizable, alternate set of micro-ops. In this work, we leverage this capability to perform the surgical insertion of speculation fences (some existing and some newly proposed) at potentially vulnerable Spectre code targets.…”

Section: Assumptions and Threat Modelmentioning

confidence: 99%

“…To perform secure microcode customization with minimal impact on performance, this work leverages contextsensitive decoding (CSD) [80], a recently proposed extension to Intel's (and others') micro-op translation mechanism that enables on-demand and context-sensitive customization of the dynamic micro-op instruction stream. In addition, this work also takes advantage of the reconfiguration framework offered by CSD, allowing the operating system and other trusted entities to dynamically control the frequency, type, and behavior of fences that are surgically inserted into the micro-op stream to secure speculative execution.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Context-Sensitive Fencing

Taram

Venkat

Tullsen

2019

Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Syst

Self Cite

View full text Add to dashboard Cite

This paper describes context-sensitive fencing (CSF), a microcode-level defense against multiple variants of Spectre. CSF leverages the ability to dynamically alter the decoding of the instruction stream, to seamlessly inject new micro-ops, including fences, only when dynamic conditions indicate they are needed. This enables the processor to protect against the attack, but with minimal impact on the efficacy of key performance features such as speculative execution. This research also examines several alternative fence implementations, and introduces three new types of fences which allow most dynamic reorderings of loads and stores, but in a way that prevents speculative accesses from changing visible cache state. These optimizations reduce the performance overhead of the defense mechanism, compared to state-of-the-art software-based fencing mechanisms by a factor of six. CCS Concepts • Security and privacy → Side-channel analysis and countermeasures; Systems security; Information flow control; • Computer systems organization → Architectures.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

Section: Assumptions and Threat Modelmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Context-Sensitive Fencing

Taram

Venkat

Tullsen

2019

Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Syst

Self Cite

View full text Add to dashboard Cite

show abstract

“…Another proposal [46] prefetches all the sensitive probeaddresses into the cache (e.g. entire encryption tables) based on the software context (e.g.…”

Section: Tolerating Attacks With Software Supportmentioning

confidence: 99%

Lookout for Zombies: Mitigating Flush+Reload Attack on Shared Caches by Monitoring Invalidated Lines

Saileshwar¹,

Qureshi²

2019

Preprint

View full text Add to dashboard Cite

OS-based page sharing is a commonly used optimization in modern systems to reduce memory footprint. Unfortunately, such sharing can cause Flush+Reload cache attacks, whereby a spy periodically flushes a cache line of shared data (using the clflush instruction) and reloads it to infer the access patterns of a victim application. Current proposals to mitigate Flush+Reload attacks are impractical as they either disable page sharing, or require application rewrite, or require OS support, or incur ISA changes. Ideally, we want to tolerate attacks without requiring any OS or ISA support and while incurring negligible performance and storage overheads.This paper makes the key observation that when a cache line is invalidated due to a Flush-Caused Invalidation (FCI), the tag and data of the invalidated line are still resident in the cache and can be used for detecting Flush-based attacks. We call lines invalidated due to FCI as Zombie lines. Our design explicitly marks such lines as Zombies, preserves the Zombie lines in the cache, and uses the hits and misses to Zombie lines to tolerate the attacks. We propose Zombie-Based Mitigation (ZBM), a simple hardware-based design that successfully guards against attacks by simply treating hits on Zombie-lines as misses to avoid any timing leaks to the attacker. We analyze the robustness of ZBM using three spy programs: attacking AES T-Tables, attacking RSA Square-and-Multiply, and Function Watcher (FW), and show that ZBM successfully defends against these attacks. Our solution requires negligible storage (4-bits per cacheline), retains OS-based page sharing, requires no OS/ISA changes, and does not incur slowdown for benign applications.

show abstract

“…Recently, various software and hardware based countermeasures have been proposed against cache-based SCAs [10,11,12,13,14,15,16,17,18,19,20]. However, these countermeasures require radical hardware modifications or these are incompatible with the performance features like super-pages, data de-duplication and simultaneous-multithreading.…”

Section: Introductionmentioning

confidence: 99%

FLUSH + PREFETCH: A countermeasure against access-driven cache-based side-channel attacks

Mukhtar

Mushtaq

Bhatti

et al. 2020

Journal of Systems Architecture

View full text Add to dashboard Cite

HAL is a multidisciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

show abstract

Mobilizing the Micro-Ops: Exploiting Context Sensitive Decoding for Security and Energy Efficiency

Cited by 20 publications

References 62 publications

Context-Sensitive Fencing

Context-Sensitive Fencing

Lookout for Zombies: Mitigating Flush+Reload Attack on Shared Caches by Monitoring Invalidated Lines

FLUSH + PREFETCH: A countermeasure against access-driven cache-based side-channel attacks

Contact Info

Product

Resources

About