Speculative taint tracking (STT): A Comprehensive Protection for Speculatively Accessed Data

Jiyong Yu, Mengjia Yan, Artem Khyzha, Adam Morrison, Josep Torrellas, Christopher W. Fletcher

Research output: Contribution to journalArticlepeer-review


Speculative execution attacks present an enormous security threat, capable of reading arbitrary program data under malicious speculation, and later exfiltrating that data over microarchitectural covert channels. This paper proposes speculative taint tracking (STT), a high security and high performance hardware mechanism to block these attacks. The main idea is that it is safe to execute and selectively forward the results of speculative instructions that read secrets, as long as we can prove that the forwarded results do not reach potential covert channels. The technical core of the paper is a new abstraction to help identify all micro-architectural covert channels, and an architecture to quickly identify when a covert channel is no longer a threat. We further conduct a detailed formal analysis on the scheme in a companion document. When evaluated on SPEC06 workloads, STT incurs 8.5% or 14.5% performance overhead relative to an insecure machine.

Original languageEnglish (US)
Pages (from-to)105-112
Number of pages8
JournalCommunications of the ACM
Issue number12
StatePublished - Dec 2021

ASJC Scopus subject areas

  • General Computer Science


Dive into the research topics of 'Speculative taint tracking (STT): A Comprehensive Protection for Speculatively Accessed Data'. Together they form a unique fingerprint.

Cite this