Exploiting Security Dependence for Conditional Speculation against Spectre Attacks

Lutan Zhao, Peinan Li, Rui Hou, Michael Huang, Peng Liu, Lixin Zhang, Dan Meng

Research output: Contribution to journalArticle


Speculative execution side-channel vulnerabilities such as Spectre reveal that conventional architecture designs lack security consideration. This paper proposes a software transparent defense mechanism, named as Conditional Speculation, against Spectre vulnerabilities found on traditional out-of-order microprocessors. It introduces the concept of security dependence to mark speculative memory instructions which could leak information with potential security risk. More specifically, security-dependent instructions are detected and marked with suspect speculation flags in the Issue Queue. All the instructions can be speculatively issued for execution in accordance with the classic out-of-order pipeline. For those instructions with suspect speculation flags, they are considered as safe instructions if their speculative execution will not refill new cache lines. Otherwise, they are considered as unsafe instructions and thus not allowed to execute speculatively. To reduce the performance impact from not executing unsafe instructions speculatively, we investigate two filtering mechanisms, Cache-hit based Hazard Filter and Trusted Page Buffer based Hazard Filter to filter out false security hazards. As for true security hazards, we fetch them from lower level caches or memory to a speculative buffer temporarily, and refill them after confirming that they are in correct execution path. The experimental results show that the hardware and performance overhead is minimal.

Original languageEnglish (US)
JournalIEEE Transactions on Computers
StateAccepted/In press - 2020

All Science Journal Classification (ASJC) codes

  • Software
  • Theoretical Computer Science
  • Hardware and Architecture
  • Computational Theory and Mathematics

Fingerprint Dive into the research topics of 'Exploiting Security Dependence for Conditional Speculation against Spectre Attacks'. Together they form a unique fingerprint.

  • Cite this