Going beyond the Limits of SFI: Flexible and Secure Hardware-Assisted In-Process Isolation with HFI
Going beyond the Limits of SFI: Flexible and Secure Hardware-Assisted In-Process Isolation with HFI
复制标题
DOI：
10.1145/3582016.3582023
复制
发表时间：
2023-03
期刊：
影响因子：
--
通讯作者：
Shravan Narayan;Tal Garfinkel;Mohammadkazem Taram;Joey Rudek;D. Moghimi;Evan Johnson;Chris Fallin
中科院分区：
文献类型：
--
作者：
Shravan Narayan;Tal Garfinkel;Mohammadkazem Taram;Joey Rudek;D. Moghimi;Evan Johnson;Chris Fallin
我们引入了硬件辅助故障隔离（HFI），这是对现有处理器的简单扩展，以支持安全，灵活和高效的过程中的隔离。 HFI解决了现有的基于软件的隔离（SFI）系统的局限性，包括：运行时开销，有限的可扩展性，对幽灵攻击的脆弱性以及与现有代码的兼容性有限。 HFI可以与当前的SFI系统（例如WebAssembly）或直接沙盒未修饰的本机二进制文件无缝集成。为了简化采用，HFI仅依赖于对现有高性能处理器的数据和控制路径的增量更改。我们使用GEM5模拟器和基于编译器的仿真来评估X86-64的HFI，以实现真实和合成工作负载的混合。
We introduce Hardware-assisted Fault Isolation (HFI), a simple extension to existing processors to support secure, flexible, and efficient in-process isolation. HFI addresses the limitations of existing software-based isolation (SFI) systems including: runtime overheads, limited scalability, vulnerability to Spectre attacks, and limited compatibility with existing code. HFI can seamlessly integrate with current SFI systems (e.g., WebAssembly), or directly sandbox unmodified native binaries. To ease adoption, HFI relies only on incremental changes to the data and control path of existing high-performance processors. We evaluate HFI for x86-64 using the gem5 simulator and compiler-based emulation on a mix of real and synthetic workloads.