论文标题
SEMPE：安全的多路径执行体系结构，用于删除有条件的分支侧通道
SeMPE: Secure Multi Path Execution Architecture for Removing Conditional Branch Side Channels
论文作者
论文摘要
侧通道漏洞的最普遍来源之一是条件分支的秘密依赖性行为（SDBCB）。最新的解决方案依赖于恒定的表达式，这需要高度编程工作并产生高性能开销。在本文中，我们提出了SEMPE，这种方法依靠体系结构支持来消除SDBCB，而无需进行太多编程工作，同时又产生了低性能的开销。关键的想法是，当遇到秘密分支时，Sempe Microharpecture提取，执行并提交分支的这两个路径，从而阻止对手从程序的分支行为中推断出秘密值。为此，SEMPE依赖于能够依次安全执行两个分支路径的体系结构。通过Microbenchs和对现实世界库的评估，我们表明SEMPE接近理想的执行时间开销，这是秘密依赖性分支的所有分支路径的执行时间之和。 SEMPE的表现优于实际上恒定时间表达语言生成的代码，高达18倍。
One of the most prevalent source of side channel vulnerabilities is the secret-dependent behavior of conditional branches (SDBCB). The state-of-the-art solution relies on Constant-Time Expressions, which require high programming effort and incur high performance overheads. In this paper, we propose SeMPE, an approach that relies on architecture support to eliminate SDBCB without requiring much programming effort while incurring low performance overheads. The key idea is that when a secret-dependent branch is encountered, the SeMPE microarchitecture fetches, executes, and commits both paths of the branch, preventing the adversary from inferring secret values from the branching behavior of the program. To enable that, SeMPE relies on an architecture that is capable of safely executing both branch paths sequentially. Through microbenchmarks and an evaluation of a real-world library, we show that SeMPE incurs near ideal execution time overheads, which is the sum of the execution time of all branch paths of secret-dependent branches. SeMPE outperforms code generated by FaCT, a constant-time expression language, by up to a factor of 18x.
