【摘要】 基于Spectre类漏洞主要由处理器中分支指令的不安全执行造成的事实，提出了一种新型分支指令安全优化机制，可有效防御Spectre V1与Spectre V2攻击。为便于部署和推广，实现了一个自动化安全工具，可在编译阶段自动识别并修改不安全的分支指令，以提升分支指令的安全性。实验结果表明，所提方法在保障安全性的同时，对处理器性能影响较小，且在硬件资源消耗方面优于现有多种典型的Spectre攻击缓解方案，展现出良好的通用性与实用性。更多还原

【Abstract】 Based on the fact that Spectre-type vulnerabilities are primarily caused by the unsafe execution of branch instructions in processors, a novel security optimization mechanism for branch instructions was proposed, which can effectively defend against attacks such as Spectre V1 and Spectre V2. An automated security tool was implemented to automatically identify and modify insecure branch instructions during the compilation phase, thereby enhancing the security of branch instructions, for the purpose of facilitating deployment and promotion. Experimental results demonstrate that the proposed method ensures security while imposing minimal impact on processor performance. It outperforms several existing typical Spectre attack mitigation schemes regarding hardware resource consumption, showing good versatility and practicality.更多还原