A Survey of Side-Channel Attacks on Branch Prediction Units

The CPU architecture landscape is constantly evolving to optimize performance. However, this has inadvertently exposed vulnerabilities such as microarchitectural traces that can be exploited in side-channel attacks. The Branch Prediction Unit (BPU) plays a critical role in improving processor performance, but also introduces vulnerabilities to microarchitectural side-channel attacks. Despite ongoing efforts to develop defensive techniques, the continued emergence of new attack methods underscores the need for comprehensive analysis. This paper aims to address this research gap by conducting a thorough investigation of BPU-based side-channel attacks. This survey presents a novel taxonomy for the systematic classification of BPU-based side-channel attacks and defenses. The attacks and defenses are categorized based on three components: manipulated unit, core technique, and disclosure method. The analysis provides a structured evaluation of the effectiveness of defense techniques against each attack technique. This study not only enhances the understanding of BPU exploitation, but also provides valuable insights for software developers and CPU designers to help them protect against evolving side-channel threats.