【摘要】 BranchScope是一种基于分支预测机制的时间侧信道攻击,攻击者利用受害者分支在intel双模态分支方向预测器的执行痕迹推断分支方向.现有大多数防护分支预测攻击和时间侧信道攻击的方案无法阻止分支在方向预测器中留下痕迹,因此不能抵御BranchScope攻击;少数有效方案建议移除分支或消除秘密信息对分支方向的依赖,但需要复杂的数据流和控制流转换.本文提出一种可有效抵御BranchScope攻击的软件防护方案FixBranchPHT,详细分析了所提方案的安全性、实用性和效率.与现有方案相比, FixBranchPHT首次通过重复执行分支,刷新分支在双模态方向预测器的秘密痕迹,修改代码的量更少,程序转换难度更低.本文首先系统分析了BranchScope攻击原理和分支方向预测机制.其次,将不同的分支结构转换为统一形式,利用循环结构实现分支的重复执行;同时利用硬件事务内存的中止回滚机制,保证关键代码不被恶意中断.再次,对方案的安全性进行了理论验证.最后,选取了四个公开的BranchScope攻击目标实验验证方案的有效性,基于nbench基准测试套件评估了防护添加后的性能.实验结果表明FixBranchPHT方案可有效抵御BranchScope攻击,平均仅产生34%的性能损耗.更多还原

【Abstract】 BranchScope is a time-side channel attack based on branch prediction mechanism. The attacker uses the execution trace of the victim’s branch in intel bimodal branch direction predictor to infer the branch direction. Most of the existing schemes defending against branch prediction attacks and time-side channel attacks cannot prevent branches from leaving traces in the direction predictor and cannot resist BranchScope attacks. A few effective schemes suggest to remove the branch or to eliminate the dependence of secret information on the branch direction, but those schemes require complex data flow and control flow conversion. In this paper, a software protection scheme, FixBranchPHT, is proposed, which can effectively resist BranchScope attacks. The security, practicability and efficiency of the proposed scheme are analyzed in detail. Compared with the existing scheme, FixBranchPHT is a new method, it refreshes the secret trace of the branch in the bimodal branch direction predictor by repeatedly executing the branch, with less code modification and lower difficulty in program conversion.This paper systematically analyzes the principle of BranchScope attack and the mechanism of branch direction prediction, then transforms different branch structures into a unified form, and uses the circular structure to realize the repeated execution of branches. Moreover, the stop and roll back mechanism of hardware transactional memory(HTM) is used to ensure that the key code cannot be interrupted by malicious attackers. Finally, the security of the scheme is verified theoretically.Four public BranchScope attack targets are selected to verify the effectiveness of the scheme, and the performance of the proposed scheme is evaluated based on nbench benchmark suite. The experimental results show that the FixBranchPHT scheme can effectively resist BranchScope attack, with an average performance loss of 34%.更多还原