Previous schemes for designing secure branch prediction unit (SBPU) based on physical isolation can only offer limited security and significantly affect BPU’s prediction capability, leading to prominent performance degradation. Moreover, encryption-based SBPU schemes based on periodic key rerandomization have the risk of being compromised by advanced attack algorithms, and the performance overhead is also considerable. To this end, this paper proposes conflict-invisible SBPU (CIBPU). CIBPU employs redundant storage design, load-aware indexing, and replacement design, as well as an encryption mechanism without requiring periodic key updates, to prevent attackers’ perception of branch conflicts. We provide a thorough security analysis, which shows that CIBPU achieves strong security throughout the BPU’s lifecycle. We implement CIBPU in a RISC-V core model in gem5. The experimental results show that CIBPU causes an average performance overhead of only 2.9%–4.0% with acceptable hardware storage overhead, which is the lowest among the state-of-the-art SBPU schemes. CIBPU has also been implemented in the open-source RISC-V core, SonicBOOM, which is then burned onto an FPGA board. The evaluation based on the board shows an average performance degradation of 2.01%, which is approximately consistent with the result obtained in gem5.

Transient execution attacks can exploit speculative execution to leak sensitive information through cache systems. Consequently, numerous cache-centric secure speculation defenses have been proposed. However, as we demonstrate both theoretically and empirically, these defenses remain vulnerable to data leakage because they neglect or fail to fully address the security issues posed by the hardware prefetcher, a critical component of modern cache systems, within the speculative execution path. In this work, we develop a new attack framework, SpectrePrefetch, which exploits hardware prefetchers as transmission mediums for leaking secrets during speculative execution. Specifically, we introduce two variants of SpectrePrefetch attacks that encode transient secrets into the prefetching patterns and prefetching confidence, respectively, and then recover secrets by probing the cache state or the prefetcher state. We launch SpectrePrefetch to attack several Intel CPUs and a Gem5 simulator, demonstrating its feasibility, robustness, bandwidth, scalability, and security implications on existing defenses. The results show that SpectrePrefetch can leak secrets at a high rate of 31.25 Kbps with an accuracy of 98.87%. More seriously, SpectrePrefetch undermines cache-centric secure speculation defenses or even secure cache designs, and is challenging to mitigate. Our experimental results show that simply restricting the prefetcher to update only on committed instructions, as proposed in MuonTrap, nearly loses all performance benefits provided by hardware prefetching. Finally, we propose a low-cost, scalable non-deterministic prefetching defense against transient execution attacks exploiting hardware prefetchers, while maintaining or even improving average performance on SPEC2017 benchmarks.

Private Set Intersection (PSI) is imperative in discovering the properties of the same data owned by two competitive parties, without revealing anything else of their respective data asset. Existing PSI solutions such as APSI and ORI-PSI suffer from severe communication and computation overhead due to inefficient communication and FHE polynomial evaluation, which hinders their deployment in practice. This issue is evident in both the upper-level protocol and the lower-level hardware platform. In this paper, we propose a novel software/hardware co-design acceleration architecture for PSI, termed as “Trident”, which includes two tightly coupled segments: from the protocol perspective, we investigate existing bottlenecks and propose a new PSI protocol with significantly less communication and computation under the security guarantee; besides, we re-architect the hardware platform by designing a PSI-specific accelerator, implemented with both FPGA and ASIC, targeting the key operations in the proposed protocol. We build a real-world experimental environment with two instantiated parties to verify the acceleration architecture, and highlight the following results: (1) up to 130$\boldsymbol{\times}$/145$\boldsymbol{\times}$speedup for the computation ofreceiverandsenderparties; (2) up to 37$\boldsymbol{\times}$reduction of communication overhead. (3) up to 93,651$\boldsymbol{\times}$and 74,326$\boldsymbol{\times}$higher energy efficiency over the CPU-based ORI-PSI and APSI, respectively.

Modern processors make use of optimization techniques such as cache and speculation mechanisms to greatly improve performance. But recent research has found that these techniques can also be exploited by attackers to perform powerful side-channel attacks. A large number of powerful cache-based attacks have been replicated and enhanced over Intel X86- and ARM-based architectures, but there is a relative lack of research on RISC-V-based architectures. Xuantie-910 and BOOM are both RISC-V-based processors. So far, cache-side channels in the unprivileged case of Xuantie-910 have not been proven, while cache attacks against BOOM are proliferating. There are two types of caches, including physically-indexed physically-tagged (PIPT) cache (adopted by Xuantie-910) and virtually-indexed physically-tagged (VIPT) cache (adopted by BOOM), corresponding to two different cache addressing forms. VIPT has higher addressing performance than PIPT, since it can directly obtain cache line index from virtual address. In this paper, we study Xuantie-910 and BOOM to explore the impact of cache design on the security of RISC-V-based microarchitecture. Specifically, we compare the impact of their cache addressing forms on precise flushing of cache lines at specified locations, which plays an important role in cache side-channel attacks. Experimental results show that for the VIPT cache in BOOM, the location-specified cache lines can be accurately flushed, and Spectre attack can be successfully carried out by using the cache side-channel. On the other hand, for the PIPT cache in Xuantie-910, it is impossible for attackers to directly and accurately flush the specified location of cache without affecting performance, which hinders the success of cache side-channel attacks. This provides us with an insight that one can adopt a VIPT-based cache with a mechanism similar to PIPT for preventing the accurate access of cache line index, which can not only keep the advantage of high-performance addressing in VIPT but also improve chip security.