The Taub Faculty of Computer Science Events and Talks

Speculative execution attacks present an enormous security threat, capable of reading arbitrary program data under malicious speculation and later exfiltrating that data over microarchitectural covert channels. This talk will describe a comprehensive hardware protection from speculative execution attacks. We will first describe Speculative Taint Tracking (STT). STT delays the execution of instructions that create covert channels until their operands are proven to be a function of non-speculative data. STT builds on a comprehensive characterization of covert channels on speculative microarchitectures and employs a novel microarchitecture for efficiently detecting when operands become non-speculative and disabling protection at that time. We will then describe Speculative Data-Oblivious Execution (SDO), which improves STT's performance by executing covert-channel creating instructions in a data-oblivious manner, i.e., so that their execution does not leak their operands. Data-oblivious execution usually implies doing the worst-case work all the time. SDO sidesteps this problem by using safe prediction to predict the work needed to satisfy the common case and subsequently perform it---all without leaking privacy.