AutoGuard: A Secure Implementation of the Conditional Branch Instruction

Side-channels are one of the major security threats to processors, which use the unintentional leakage of time, power consumption, and electromagnetic radiation from computers as a basis for obtaining important secret data in the computers. The Branch Target Buffer (BTB) and Branch History Buffer (BHB) side-channels are the recently discovered side-channel vulnerabilities that can be utilized to implement many high-threat hardware vulnerability attacks like Spectre and BranchScope. However, although there are many effective defense methods for BTB-based and BHB-based side-channel attacks, the relative isolation of each method from each other seriously affects the processor's performance and also increases resource consumption. In this paper, we propose a secure conditional branching architecture (we call it AutoGuard), which is a novel mitigation mechanism for BTB-based and BHB-based Side Channel Attacks (SCAs). Meanwhile, AutoGuard is also capable of effectively mitigating Spectre attacks (including variant 1 and variant 2). AutoGuard first ensures that only the correct addresses can be executed during the conditional branch by address blocking and adding partial instruction dependencies. Subsequently, AutoGuard modifies the microarchitectural execution process of the partial conditional branch to safely execute instructions with the assistance of the Return Stack Buffer (RSB). Finally, AutoGuard determines the final instruction to be executed by determining the instruction address at the top of the RSB stack and the top of the execution stack. Through the above process, we design a security gadget in AutoGuard that can automatically identify and modify conditional branches to improve their security. We successfully deployed AutoGuard on multiple processors and Linux kernels. Through experimental evaluation, we find that AutoGuard consumes fewer resources and has a lesser performance impact than other existing BTB-based and BHB-based side-channel attack protection methods.