{"id":"https://openalex.org/W4385521730","doi":"https://doi.org/10.1109/tcsi.2023.3298913","title":"PMU-Spill: A New Side Channel for Transient Execution Attacks","display_name":"PMU-Spill: A New Side Channel for Transient Execution Attacks","publication_year":2023,"publication_date":"2023-08-03","ids":{"openalex":"https://openalex.org/W4385521730","doi":"https://doi.org/10.1109/tcsi.2023.3298913"},"language":"en","primary_location":{"id":"doi:10.1109/tcsi.2023.3298913","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tcsi.2023.3298913","pdf_url":null,"source":{"id":"https://openalex.org/S116977442","display_name":"IEEE Transactions on Circuits and Systems I Regular Papers","issn_l":"1549-8328","issn":["1549-8328","1558-0806"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Circuits and Systems I: Regular Papers","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5003865038","display_name":"Pengfei Qiu","orcid":"https://orcid.org/0009-0009-4043-2119"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Pengfei Qiu","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Beijing University of Posts and Telecommunications (BUPT), Ministry of Education, Beijing, China"],"raw_orcid":"https://orcid.org/0009-0009-4043-2119","affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Beijing University of Posts and Telecommunications (BUPT), Ministry of Education, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075905329","display_name":"Qiang Gao","orcid":"https://orcid.org/0000-0001-7860-6692"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Qiang Gao","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Beijing University of Posts and Telecommunications (BUPT), Ministry of Education, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Beijing University of Posts and Telecommunications (BUPT), Ministry of Education, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102749847","display_name":"Chang Liu","orcid":"https://orcid.org/0000-0002-1834-4958"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chang Liu","raw_affiliation_strings":["Department of Computer Science and Technology, Tsinghua University, Beijing, China","Zhongguancun Laboratory, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0002-1834-4958","affiliations":[{"raw_affiliation_string":"Department of Computer Science and Technology, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]},{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100450575","display_name":"Dongsheng Wang","orcid":"https://orcid.org/0000-0001-5779-9026"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Dongsheng Wang","raw_affiliation_strings":["Department of Computer Science and Technology, Tsinghua University, Beijing, China","Zhongguancun Laboratory, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Technology, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]},{"raw_affiliation_string":"Zhongguancun Laboratory, Beijing, China","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058507537","display_name":"Yongqiang Lyu","orcid":"https://orcid.org/0000-0003-2573-963X"},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yongqiang Lyu","raw_affiliation_strings":["Beijing National Research Center for Information Science and Technology, Tsinghua University, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0003-2573-963X","affiliations":[{"raw_affiliation_string":"Beijing National Research Center for Information Science and Technology, Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100673949","display_name":"Xiaoyong Li","orcid":"https://orcid.org/0000-0001-5597-9306"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoyong Li","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Beijing University of Posts and Telecommunications (BUPT), Ministry of Education, Beijing, China"],"raw_orcid":"https://orcid.org/0000-0001-5597-9306","affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Beijing University of Posts and Telecommunications (BUPT), Ministry of Education, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5044874015","display_name":"Chunlu Wang","orcid":"https://orcid.org/0000-0002-0343-5830"},"institutions":[{"id":"https://openalex.org/I139759216","display_name":"Beijing University of Posts and Telecommunications","ror":"https://ror.org/04w9fbh59","country_code":"CN","type":"education","lineage":["https://openalex.org/I139759216"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chunlu Wang","raw_affiliation_strings":["Key Laboratory of Trustworthy Distributed Computing and Service, Beijing University of Posts and Telecommunications (BUPT), Ministry of Education, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Key Laboratory of Trustworthy Distributed Computing and Service, Beijing University of Posts and Telecommunications (BUPT), Ministry of Education, Beijing, China","institution_ids":["https://openalex.org/I139759216"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5012474783","display_name":"Gang Qu","orcid":"https://orcid.org/0000-0001-6759-8949"},"institutions":[{"id":"https://openalex.org/I66946132","display_name":"University of Maryland, College Park","ror":"https://ror.org/047s2c258","country_code":"US","type":"education","lineage":["https://openalex.org/I66946132"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Gang Qu","raw_affiliation_strings":["Department of Electrical and Computer Engineering and the Institute for Systems Research, University of Maryland, College Park, MD, USA"],"raw_orcid":"https://orcid.org/0000-0001-6759-8949","affiliations":[{"raw_affiliation_string":"Department of Electrical and Computer Engineering and the Institute for Systems Research, University of Maryland, College Park, MD, USA","institution_ids":["https://openalex.org/I66946132"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":1.4276,"has_fulltext":false,"cited_by_count":9,"citation_normalized_percentile":{"value":0.84421303,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":96,"max":97},"biblio":{"volume":"70","issue":"12","first_page":"5048","last_page":"5059"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12122","display_name":"Physical Unclonable Functions (PUFs) and Hardware Security","score":0.9872999787330627,"subfield":{"id":"https://openalex.org/subfields/1708","display_name":"Hardware and Architecture"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11005","display_name":"Radiation Effects in Electronics","score":0.979200005531311,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7925195693969727},{"id":"https://openalex.org/keywords/side-channel-attack","display_name":"Side channel attack","score":0.6931442022323608},{"id":"https://openalex.org/keywords/guard","display_name":"Guard (computer science)","score":0.6921016573905945},{"id":"https://openalex.org/keywords/microarchitecture","display_name":"Microarchitecture","score":0.6561272144317627},{"id":"https://openalex.org/keywords/transient","display_name":"Transient (computer programming)","score":0.6526687145233154},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5277983546257019},{"id":"https://openalex.org/keywords/embedded-system","display_name":"Embedded system","score":0.4864951968193054},{"id":"https://openalex.org/keywords/branch-predictor","display_name":"Branch predictor","score":0.48492294549942017},{"id":"https://openalex.org/keywords/byte","display_name":"Byte","score":0.47795939445495605},{"id":"https://openalex.org/keywords/throughput","display_name":"Throughput","score":0.4117475748062134},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.38864660263061523},{"id":"https://openalex.org/keywords/real-time-computing","display_name":"Real-time computing","score":0.35904014110565186},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.3049234449863434},{"id":"https://openalex.org/keywords/cryptography","display_name":"Cryptography","score":0.17787081003189087}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7925195693969727},{"id":"https://openalex.org/C49289754","wikidata":"https://www.wikidata.org/wiki/Q2267081","display_name":"Side channel attack","level":3,"score":0.6931442022323608},{"id":"https://openalex.org/C141141315","wikidata":"https://www.wikidata.org/wiki/Q2379942","display_name":"Guard (computer science)","level":2,"score":0.6921016573905945},{"id":"https://openalex.org/C107598950","wikidata":"https://www.wikidata.org/wiki/Q259864","display_name":"Microarchitecture","level":2,"score":0.6561272144317627},{"id":"https://openalex.org/C2780799671","wikidata":"https://www.wikidata.org/wiki/Q17087362","display_name":"Transient (computer programming)","level":2,"score":0.6526687145233154},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5277983546257019},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.4864951968193054},{"id":"https://openalex.org/C168522837","wikidata":"https://www.wikidata.org/wiki/Q679552","display_name":"Branch predictor","level":2,"score":0.48492294549942017},{"id":"https://openalex.org/C43364308","wikidata":"https://www.wikidata.org/wiki/Q8799","display_name":"Byte","level":2,"score":0.47795939445495605},{"id":"https://openalex.org/C157764524","wikidata":"https://www.wikidata.org/wiki/Q1383412","display_name":"Throughput","level":3,"score":0.4117475748062134},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.38864660263061523},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.35904014110565186},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.3049234449863434},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.17787081003189087},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C555944384","wikidata":"https://www.wikidata.org/wiki/Q249","display_name":"Wireless","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tcsi.2023.3298913","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tcsi.2023.3298913","pdf_url":null,"source":{"id":"https://openalex.org/S116977442","display_name":"IEEE Transactions on Circuits and Systems I Regular Papers","issn_l":"1549-8328","issn":["1549-8328","1558-0806"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Circuits and Systems I: Regular Papers","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3477364470","display_name":null,"funder_award_id":"2021YFB3100902","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"},{"id":"https://openalex.org/G6714212579","display_name":null,"funder_award_id":"62072263","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G7415212279","display_name":null,"funder_award_id":"U1836215","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320322392","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549"},{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":50,"referenced_works":["https://openalex.org/W1934458198","https://openalex.org/W1964281299","https://openalex.org/W2024540116","https://openalex.org/W2096961019","https://openalex.org/W2103289002","https://openalex.org/W2199175040","https://openalex.org/W2337480911","https://openalex.org/W2404948481","https://openalex.org/W2406174928","https://openalex.org/W2606774910","https://openalex.org/W2625850712","https://openalex.org/W2768516003","https://openalex.org/W2799920367","https://openalex.org/W2807403537","https://openalex.org/W2810584084","https://openalex.org/W2888798936","https://openalex.org/W2897675008","https://openalex.org/W2903910116","https://openalex.org/W2904062476","https://openalex.org/W2954241526","https://openalex.org/W2963311060","https://openalex.org/W2964026421","https://openalex.org/W2976763854","https://openalex.org/W2989660162","https://openalex.org/W2990246449","https://openalex.org/W2998338048","https://openalex.org/W3004850737","https://openalex.org/W3007037833","https://openalex.org/W3008727730","https://openalex.org/W3038933981","https://openalex.org/W3088385171","https://openalex.org/W3095391095","https://openalex.org/W3100860658","https://openalex.org/W3112409568","https://openalex.org/W3152901657","https://openalex.org/W3153001680","https://openalex.org/W3212495950","https://openalex.org/W4213339980","https://openalex.org/W4233119454","https://openalex.org/W4318685769","https://openalex.org/W4320025539","https://openalex.org/W4379113633","https://openalex.org/W6628261430","https://openalex.org/W6712237015","https://openalex.org/W6725368715","https://openalex.org/W6753443810","https://openalex.org/W6754306559","https://openalex.org/W6766700459","https://openalex.org/W6777023048","https://openalex.org/W6801391798"],"related_works":["https://openalex.org/W1916582918","https://openalex.org/W2811273613","https://openalex.org/W2381374827","https://openalex.org/W2109440006","https://openalex.org/W4235677263","https://openalex.org/W2745771918","https://openalex.org/W1558760591","https://openalex.org/W3194312717","https://openalex.org/W2296662050","https://openalex.org/W2262408825"],"abstract_inverted_index":{"Performance":[0],"Monitor":[1],"Unit":[2],"(PMU)":[3],"is":[4,29,36,72,180],"an":[5,27,189],"important":[6],"hardware":[7,74,146],"module":[8],"in":[9,50,68,100,155],"mainstream":[10],"processors,":[11],"which":[12,71],"counts":[13],"various":[14],"architectural":[15],"and":[16,115,198],"microarchitectural":[17],"events":[18,41,64,129],"during":[19],"the":[20,23,40,82,138,160,175,199,211,216],"run-time":[21],"of":[22,61,88,108,177,192],"processor.":[24],"Theoretically,":[25],"if":[26],"instruction":[28],"executed":[30],"but":[31],"doesn\u2019t":[32],"successfully":[33],"retire":[34],"(this":[35],"called":[37],"transient":[38,69,101,127],"execution),":[39],"it":[42],"triggers":[43],"needn\u2019t":[44],"be":[45,153,204],"recorded":[46],"by":[47,164,215],"PMU.":[48],"However,":[49],"this":[51,78],"study,":[52],"we":[53,80],"discover":[54],"that":[55,65,92,117,124,147,174],"current":[56],"PMU":[57,109,122,134,140,150,217],"implementations":[58],"are":[59,66,131],"capable":[60],"recording":[62],"some":[63],"triggered":[67],"executions,":[70],"a":[73,85,105],"vulnerability.":[75],"Based":[76],"on":[77,111,144,194],"vulnerability,":[79],"propose":[81],"PMU-Spill":[83,156,178],"attack,":[84],"new":[86],"kind":[87],"side":[89],"channel":[90],"attack":[91,157,179],"enables":[93],"attackers":[94],"to":[95,158,182,209],"maliciously":[96],"leak":[97,159],"secret":[98,161],"data":[99,162],"executions.":[102],"We":[103,142],"perform":[104],"thorough":[106],"study":[107],"counters":[110,123,135,151],"five":[112],"Intel":[113,165],"processors":[114],"find":[116],"they":[118],"all":[119,137],"have":[120],"vulnerable":[121,133,149],"will":[125],"measure":[126],"execution":[128],"(there":[130],"162":[132],"among":[136],"383":[139],"counters).":[141],"demonstrate":[143],"real":[145],"112":[148],"can":[152,203],"utilized":[154],"protected":[163],"Software":[166],"Guard":[167],"Extensions":[168],"(SGX).":[169],"Besides,":[170],"our":[171],"experiments":[172],"suggest":[173],"throughput":[176],"up":[181],"291.2":[183],"bytes":[184],"per":[185],"second":[186],"(Bps)":[187],"with":[188],"error":[190],"rate":[191],"2.45%":[193],"average.":[195],"This":[196],"discovery":[197],"corresponding":[200],"mitigation":[201],"methods":[202],"helpful":[205],"for":[206],"microarchitecture":[207],"designers":[208],"reevaluate":[210],"security":[212],"risks":[213],"induced":[214],"module.":[218]},"counts_by_year":[{"year":2025,"cited_by_count":3},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":3}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}