论文标题
瞬态执行攻击的调查
Survey of Transient Execution Attacks
论文作者
论文摘要
瞬态执行攻击（也称为投机执行攻击）在利用指令的瞬态执行时引起了极大的兴趣，例如在分支预测期间，以泄漏数据。瞬态执行是现代计算机架构的基础，但构成了证明的安全风险。自2018年1月首次披露Spectre和Meltdown攻击以来，已经提出了许多新的攻击类型或攻击变体。这些攻击促使计算机架构师重新考虑处理器的设计并提出硬件防御。本文总结了瞬态执行攻击的组件和阶段。进一步讨论和分类每个组件。为每个组件提出了一组指标，以评估攻击的可行性。此外，总结了攻击中可以泄漏的数据。此外，比较了现有的攻击，并根据拟议的指标讨论了这些攻击的局限性。最后，讨论了文献中的微体系结构层面的现有缓解。
Transient execution attacks, also called speculative execution attacks, have drawn much interest as they exploit the transient execution of instructions, e.g., during branch prediction, to leak data. Transient execution is fundamental to modern computer architectures, yet poses a security risk as has been demonstrated. Since the first disclosure of Spectre and Meltdown attacks in January 2018, a number of new attack types or variants of the attacks have been presented. These attacks have motivated computer architects to rethink the design of processors and propose hardware defenses. This paper summarizes the components and the phases of the transient execution attacks. Each of the components is further discussed and categorized. A set of metrics is proposed for each component to evaluate the feasibility of an attack. Moreover, the data that can be leaked in the attacks are summarized. Further, the existing attacks are compared, and the limitations of these attacks are discussed based on the proposed metrics. In the end, existing mitigations at the micro-architecture level from literature are discussed.
