2021/08/04 by Tao Zhang, Zhang, Tao, Timothy Lesch +5
Computer Science · #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Hardware Architecture (cs.AR) #Network Security and Intrusion Detection #Security and Verification in Computing #Software System Performance and Reliability #cs.AR #cs.CR
paper · pdf · doi:10.48550/arxiv.2108.02156
14 pages
openalex publication_date 2021/08/04 · arxiv created 2022/04/20 · arxiv updated 2022/04/22 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Modern processors have suffered a deluge of threats exploiting branch instruction collisions inside the branch prediction unit (BPU), from eavesdropping on secret-related branch operations to triggering malicious speculative executions. Protecting branch predictors tends to be challenging from both security and performance perspectives. For example, partitioning or flushing BPU can stop certain collision-based exploits but only to a limited extent. Meanwhile, such mitigations negatively affect branch prediction accuracy and further CPU performance. This paper proposes Secret Token Branch Prediction Unit (STBPU), a secure BPU design to defend against collision-based transient execution attacks and BPU side channels while incurring minimal performance overhead. STBPU resolves the challenges above by customizing data representation inside BPU for each software entity requiring isolation. In addition, to prevent an attacker from using brute force techniques to trigger malicious branch instruction collisions, STBPU actively monitors the prediction-related events and preemptively changes BPU data representation.