Specu Sp culative T Taint T Track cking ( (ST STT): A Comp Comprehensive Prot otection on for or Transiently Accessed Secrets Ac Jiyong Yu, Mengjia Yan, Artem Khyzha,* Adam Morrison,* Josep Torrellas, Christopher W. Fletcher University of Illinois at Urbana-Champaign ∗ Tel Aviv University The Blavatnik School of Computer Science The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets Sc Scope pe: Protecting ng Trans nsient Se Secrets over any Covert Ch Chan annel Transient Covert channel Start speculative Instruction accesses secret transmits secret execution “Access instruction” e.g., Spectre Variant 1: if (addr < N) { // start speculation secret = A[addr]; // access secret d = transmit( secret ); // covert channel } The Blavatnik School of Computer Science 2 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Ad Adver ersary Powerful attacker ● Observes HW resource contention at FF/cycle granularity ● I.e., monitors every uarch covert channel transmit( secret ) ● From within same thread ○ Adjacent SMT context ○ Another core ○ Etc. ○ The Blavatnik School of Computer Science 3 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets Ma Main I Insight of of ST STT It is safe to execute and forward the results of transient access instructions Up until those results reach a covert channel Start speculation Access instruction Covert channel Issue more work early à Lower performance overhead If squash: Execute access + unreachable dependent instructions If no squash : if (addr < N) { Execute after delay Safe to execute secret = A[addr]; Safe to execute secret’ = secret - 1; Delayed/Unreachable d = transmit( secret’ ); } The Blavatnik School of Computer Science 4 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Secu Security definition Non-interference with respect to transiently read data = Arbitrary speculative execution can only leak retired register file state (not arbitrary program memory) Blocks The Universal Read Gadget == many Spectre variants (1, 3, 4, ..), MDS attacks, Meltdown, etc. The Blavatnik School of Computer Science 5 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
STT, Informally ST Performance: Walk through (not around) rock == Forward data aggressively Security: Do not fall off rock == Leak zero bits over uarch side/covert channels The Blavatnik School of Computer Science 6 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets Re Rest of talk Start speculative Access instruction Covert channel execution if (addr < N) { 1.) What can form a covert channel? secret = A[addr]; d = transmit( secret ); } ??? 2.) How to protect secrets from covert channels The Blavatnik School of Computer Science 7 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets 1. 1.) ) What can an for orm a a covert chan annel? à New abstraction for covert channels on spec. machines Find new (classes of) covert channels in the process The Blavatnik School of Computer Science 8 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets Co Cover ert t Ch Channel els are e Ex Explicit or or Im Implicit Explicit channel: Secret passed to instruction w/ input-dependent resource contention Examples: loads, floating point arithmetic Implicit channel: Secret influences the sequence of instructions executed/indirectly influences how those instructions execute Examples: branches, memory dependence speculation The Blavatnik School of Computer Science 9 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets Implici Imp cit Ch Channel els can lea eak k at Pr Prediction an and Re Resolution ti time Prediction time: When predictor state becomes a function of secret Resolution time: When predictor is not a function of secret Example: secret != prediction à squash if (secret) { y++ } à load executes twice! z = *( non-secret ) The Blavatnik School of Computer Science 10 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets Imp Implici cit Ch Channel els ma may y fea eature e Ex Explicit or or Im Implicit br branc nche hes Explicit Branch: control flow instruction (branch, jump, etc.). Implicit Branch: HW branch, “which direction” is observable The implicit branch Example: store-to-load forwarding Re-write load as: * secret = foo; if (secret==non-secret) { bar = *( non-secret ); forward from LSQ } Whether load goes to cache else cache_read( non-secret ) depends on secret ! The Blavatnik School of Computer Science The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets Putting it all to Pu together The Blavatnik School of Computer Science 12 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets 2. 2.) Ho ) How t to pr protec ect sec secrets fr s from c m cover ert c cha hannel nnels à Novel HW dynamic taint tracking scheme w/ “Fast Untaint” The Blavatnik School of Computer Science 13 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets Mi Microarchi hitectur ture spe pecifies… 1.) Access instructions … access secrets 2.) Transmit instructions … form explicit channels E.g., access instructions = transmit instructions = loads 3.) Implicit channel branch predicates E.g., store à load forwarding “if load addr == addr of older in-flight store” 4.) Visibility Point (VP): point, after which, speculation is ‘unsafe’ E.g., oldest unresolved branch The Blavatnik School of Computer Science 14 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets Taint propagation in hardware Ta ○ Hardware taints instruction output registers of 1.) Access instructions before Visibility Point (VP) 2.) Instructions with tainted inputs ■ Taint not propagated to memory on stores ■ Tainted values are protected “Visibility Point” (VP) if (addr < N) { Taint shown secret = A[addr]; // access instruction in red secret’ = secret - 1; d = transmit( secret’ ); } The Blavatnik School of Computer Science The Raymond and Beverly Sackler Faculty of Exact Sciences 15 Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets Ne New “ “UnT UnTain aint” ” pr propa pagati tion n in n ha hardw dware ○ Hardware untaints instruction output registers of 1.) Access instructions reached VP 2.) Instructions with all inputs untainted ■ Protection disabled when instr operands become untainted Taint is dynamic over instruction lifetime if (addr < N) { if (addr < N) { Branch resolves secret = A[addr]; secret = A[addr]; secret -= 1; secret -= 1; d = transmit( secret ); d = transmit( secret ); } } Non-trivial! The Blavatnik School of Computer Science The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University 16
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets Who is Wh s aware of taint Only processor core (e.g., rename table) tracks taint Processor memory system does not track taint ● Taint is transparent to SW/Users ● The Blavatnik School of Computer Science 17 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Open Enclave Workshop Speculative Taint Tracking: A Comprehensive Protection for Transiently Accessed Secrets Recall: Us Using taint to block co covert channels Block Explicit Channels: Delay execution of transmit instructions until operands untainted Block Prediction-time Implicit Channels: Delay predictor updates for explicit/implicit branches until untainted Block Resolution-time Implicit Channels: Delay explicit/implicit branch resolution until predicate (operands) untainted The Blavatnik School of Computer Science 18 The Raymond and Beverly Sackler Faculty of Exact Sciences Tel Aviv University
Recommend
More recommend
