Repository logo
 

MuonTrap: Preventing Cross-Domain Spectre-Like Attacks by Capturing Speculative State

Accepted version
Peer-reviewed

Type

Conference Object

Change log

Authors

Jones, TM 

Abstract

The disclosure of the Spectre speculative-execution attacks in January 2018 has left a severe vulnerability that systems are still struggling with how to patch. The solutions that currently exist tend to have incomplete coverage, perform badly, or have highly undesirable edge cases that cause application domains to break. MuonTrap allows processors to continue to speculate, avoiding significant reductions in performance, without impacting security. We instead prevent the propagation of any state based on speculative execution, by placing the results of speculative cache accesses into a small, fast L0 filter cache, that is non-inclusive, non-exclusive with the rest of the cache hierarchy. This isolates all parts of the system that can't be quickly cleared on any change in threat domain. MuonTrap uses these speculative filter caches, which are cleared on context and protection-domain switches, along with a series of extensions to the cache coherence protocol and prefetcher. This renders systems immune to cross-domain information leakage via Spectre and a host of similar attacks based on speculative execution, with low performance impact and few changes to the CPU design.

Description

Keywords

Microarchitecture, Hardware Security, Speculative Execution, Spectre

Journal Title

Proceedings - International Symposium on Computer Architecture

Conference Name

ISCA '20: The 47th Annual International Symposium on Computer Architecture

Journal ISSN

1063-6897

Volume Title

Publisher

IEEE

Rights

All rights reserved
Sponsorship
Engineering and Physical Sciences Research Council (EP/K026399/1)
Engineering and Physical Sciences Research Council (EP/M506485/1)
Engineering and Physical Sciences Research Council (EP/P020011/1)
EPSRC (1510365)
Arm Limited
Relationships
Is supplemented by: