ISCA’20 Section 5B Speculative Data-Oblivious Execution: Mobilizing Safe Prediction For Safe and Effi ficient Speculative Execution JIYONG YU, NAMRATA MANTRI, JOSEP TORRELLAS, ADAM MORRISON*, CHRISTOPHER W. FLETCHER UNIVERSITY OF ILLINOIS AT URBANA-CHAMPAIGN ∗ TEL AVIV UNIVERSITY 1
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Execution Attacks ▪ Attacker exploits speculative execution to leak data through hardware usage 2
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Execution Attacks ▪ Attacker exploits speculative execution to leak data through hardware usage Speculation starts if (addr < N) { // speculation // access instruction secret = load [addr]; // transmit instruction transmit secret; } time 3
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Execution Attacks ▪ Attacker exploits speculative execution to leak data through hardware usage if (addr < N) { // speculation Speculative secret // access instruction is accessed secret = load [addr]; // transmit instruction transmit secret; } time 4
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Execution Attacks ▪ Attacker exploits speculative execution to leak data through hardware usage if (addr < N) { // speculation // access instruction secret = load [addr]; Speculative secret is transmitted // transmit instruction via hardware usage transmit secret; } time 5
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Execution Attacks ▪ Attacker exploits speculative execution to leak data through hardware usage if (addr < N) { // speculation // access instruction secret = load [addr]; Speculative secret is transmitted // transmit instruction via hardware usage transmit secret; } Shared hardware time 6
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Execution Attacks ▪ Attacker exploits speculative execution to leak data through hardware usage if (addr < N) { // speculation addr < N // access instruction secret = load [addr]; // transmit instruction transmit secret; } Shared hardware time 7
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Execution Attacks ▪ Attacker exploits speculative execution to leak data through hardware usage if (addr < N) { // speculation addr > N // access instruction secret = load [addr]; // transmit instruction transmit secret; } Shared hardware time 8
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Execution Attacks ▪ Attacker exploits speculative execution to leak data through hardware usage if (addr < N) { // speculation addr > N // access instruction secret = load [addr]; // transmit instruction transmit secret; Attacker infers secret via } hardware state Shared hardware time 9
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Existing Mitigations ▪ How to deal with ? transmit secret 10
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Existing Mitigations Transmit Hardware ▪ How to deal with ? transmit secret instruction vulnerability ▪ Solution: Delayed Execution load Cache side channel ▪ Prior works: SpecShield [PACT’19], NDA [MICRO’19], STT [MICRO’19] Floating point Subnormal floating operations point …… …… 11
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Existing Mitigations Transmit Hardware ▪ How to deal with ? transmit secret instruction vulnerability ▪ Solution: Delayed Execution load Cache side channel ▪ Prior works: SpecShield [PACT’19], NDA [MICRO’19], STT [MICRO’19] Floating point Subnormal floating operations point …… …… if (addr < N) { // speculation // access instruction secret = load [addr]; // transmit instruction Delaying execution transmit secret; } 12
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Existing Mitigations Transmit Hardware ▪ How to deal with ? transmit secret instruction vulnerability ▪ Solution: Delayed Execution load Cache side channel ▪ Prior works: SpecShield [PACT’19], NDA [MICRO’19], STT [MICRO’19] Floating point Subnormal floating operations point ▪ Strong security guarantee …… …… ▪ High performance overhead 13
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Existing Mitigations ▪ How to deal with ? transmit secret Register File ▪ Solution: Delayed Execution … ▪ Prior works: SpecShield [PACT’19], NDA [MICRO’19], secret transmit Execute Unit STT [MICRO’19] Improve the performance of Delayed Execution … ▪ Problem: High performance overhead and instruction instruction instruction instruction Maintain its security guarantee 14
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Data Oblivious (SDO): Executive Summary 15
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Data Oblivious (SDO): Executive Summary Idea 1. Execute transmit secret High performance eliminating operand-dependent hardware usage 16
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Data Oblivious (SDO): Executive Summary Idea 1. Execute transmit secret by eliminating operand-dependent hardware usage (being data oblivious) High security, low performance High performance eliminating operand-dependent hardware usage 17
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Data Oblivious (SDO): Executive Summary Idea 1. Execute transmit secret by eliminating operand-dependent hardware usage (being data oblivious) High security, low performance High performance Idea 2. Predict how the execution should be performed eliminating operand-dependent hardware usage 18
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Speculative Data Oblivious (SDO): Executive Summary Idea 1. Execute transmit secret by eliminating operand-dependent hardware usage (being data oblivious) High security, low performance High performance Idea 2. Predict how the execution should be performed Problem : combining idea 1 & 2 creates security problems Solution : build on top of Speculative Taint Tracking (STT) 19
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Example: Subnormal Floating-point Operation ▪ Double-precision floating point ▪ Normal input: (2.23e−308, 1.79e308), processed by Floating -Point Unit (FPU) ▪ Subnormal input: (4.9e−324, 2.23e−308), requiring microcode assist Latency = X (a is normal) && Fast path (FPU only) (b is normal) a = fpop a, b Latency = Y > X (a is subnormal) || Slow path (with (b is subnormal) microcode assist) 20
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Problem: Leaking Whether Input is Normal/Subnormal Latency = X Fast path (FPU only) // owned by victim a = fpmult a, b Latency = Y > X Slow path (with microcode assist) // owned by attacker c = fpmult c, d 21
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Problem: Leaking Whether Input is Normal/Subnormal Latency = X Fast path (FPU only) // owned by victim a = fpmult a, b Latency = Y > X Slow path (with microcode assist) // owned by attacker c = fpmult c, d a = fpmult a, b c = fpmult c, d Both a and b timeline are normal 0 X Using fast path 22
Introduction Speculative Data-Oblivious SDO Framework SDO for Loads Evaluation Conclusion Problem: Leaking Whether Input is Normal/Subnormal Latency = X Fast path (FPU only) // owned by victim a = fpmult a, b Latency = Y > X Slow path (with microcode assist) // owned by attacker c = fpmult c, d a = fpmult a, b c = fpmult c, d Both a and b timeline are normal 0 X Using fast path c = fpmult c, d a = fpmult a, b a or b is timeline subnormal Using slow path Y 0 23
Recommend
More recommend
