一句话：提出 Jamais Vu：检测指令被 squash 后，在重插入流水线前自动加 fence，阻止微架构重放攻击。
微架构重放攻击（MRA）通过强制流水线冲刷，使受害者指令反复执行，以消除微架构侧信道中的测量波动；它甚至可重放最终会退休的指令，不限于瞬态执行攻击。本文提出首个阻止 MRA 的技术 Jamais Vu：检测指令被 squash 后，在其重新插入流水线前自动放置 fence，阻止其再次被冲刷重放。作者给出多种安全、开销与复杂度权衡的设计。其中 Epoch-Loop-Rem 能有效缓解 MRA，良性执行平均时间开销 13.8%，仅需 counting Bloom filters；更简单的 Clear-on-Retire 平均开销仅 2.9%，但安全性较低。
Microarchitectural Replay Attacks (MRAs) enable an attacker to eliminate the measurement variation in potentially any microarchitectural side channel—even if the victim instruction is supposed to execute only once. In an MRA, the attacker forces pipeline flushes in order to repeatedly re-execute the victim instruction and denoise the channel. MRAs are not limited to transient execution attacks: the replayed victim can be an instruction that will eventually retire. This paper presents the first technique to thwart MRAs. The technique, called Jamais Vu, detects when an instruction is squashed. Then, as the instruction is re-inserted into the pipeline, Jamais Vu automatically places a fence before it to prevent the attacker from squashing it again. This paper presents several Jamais Vu designs that offer different trade-offs between security, execution overhead, and implementation complexity. One design, called Epoch-Loop-Rem, effectively mitigates MRAs, has an average execution time overhead of 13.8% in benign executions, and only needs counting Bloom filters. An even simpler design, called Clear-on-Retire, has an average execution time overhead of only 2.9%, although it is less secure.
DOI 原文 ·
@inproceedings{paperbot6090,
title = {Jamais vu: thwarting microarchitectural replay attacks},
author = {Dimitrios Skarlatos and Zirui Neil Zhao and Riccardo Paccagnella and Christopher W. Fletcher and Josep Torrellas},
booktitle = {ASPLOS},
year = {2021},
doi = {10.1145/3445814.3446716}
}