Dynamic Process Isolation: Research by Cloudflare and TU Graz

Introduced Dynamic Process Isolation, a novel Spectre defense mechanism for Cloudflare Workers. This defense uses hardware performance counters to detect branch mispredictions indicative of Spectre variant 1 attacks. Upon detection, suspicious Workers are moved into separate OS processes, leveraging kernel-level defenses. The research, conducted in partnership with TU Graz, also developed a working Spectre variant 1 attack that could leak memory at 120 bits per hour in an ideal scenario, demonstrating the need for enhanced defenses.