Okapi: Efficiently Safeguarding Speculative Data Accesses in Sandboxed Environments

arXiv:2312.08156v2 Announce Type: replace
Abstract: This paper introduces Okapi, a new hardware/software cross-layer architecture designed to mitigate Transient Execution Side Channel (TES) attacks in modern computing systems. Okapi enforces sandboxing for speculative execution, providing a hardware basis that can replace expensive speculation barriers in software.
At its core, Okapi allows for speculative data accesses to a memory page only after the page has been accessed non-speculatively at least once by the current trust domain. The granularity of the trust domains …

architecture arxiv attacks can channel computing cs.ar cs.cr data environments hardware safeguarding sandboxing software speculative execution systems