Systematic Analysis of Moving Target Defenses for Branch Prediction Attacks

While branch predictors play a crucial role in high-performance processors, they are easy targets for micro-architectural attacks. A promising direction to counter these attacks is to randomize the branch predictor's state periodically to create moving targets for the attacker. While such approaches have been successfully applied to mitigate similar attacks in cache memories, applying them in branch predictors offers a unique set of challenges. Unlike cache memories, branch predictors differ widely in architecture. Their proximity to the processor's pipeline requires the countermeasures to be highly efficient to minimize overheads. In this paper, we present a systematic analysis of the moving target countermeasure on branch predictors. To capture different branch predictor architectures, we propose a generic branch predictor model. We use the model to formally define various attack strategies on branch predictors and then use the attack complexities to systematically derive randomization intervals for various mitigation techniques. We then identify the appropriate mitigation to be applied for a branch predictor based on the performance overheads incurred. For evaluation, we instantiate five different branch predictors from the generic predictor model and adapt the attack models and randomization techniques for each predictor. We compute the randomization interval for mitigation strategies and show that the interval intricately depends on the branch predictor architecture and the mitigation technique. We study the performance and area overheads by extending the branch predictor in an OpenRISC processor, enhanced with the randomization countermeasure.