Efficient Sealable Protection Keys for RISC-V
Efficient Sealable Protection Keys for RISC-V
复制标题
RISC-V 的高效可密封保护密钥
DOI：
--
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
A. Joshi
中科院分区：
文献类型：
--
作者：
Leila Delshadtehrani;Sadullah Canakci;Manuel Egele;A. Joshi
随着基于软件的攻击数量的不断增加，将敏感数据和受信任的软件组件与不受信任的第三方组件隔离开来的努力越来越多。硬件辅助的进程内隔离机制使软件开发人员能够将进程划分为隔离的组件，从而保护敏感数据不受不可信组件的影响。然而，在现代处理器（如ARM和IBM Power）中，大多数现有的硬件辅助的进程内隔离机制都依赖于昂贵的内核操作来在可信域和不可信域之间进行切换。最近，英特尔为进程内内存隔离引入了一个新的硬件特性，称为内存保护密钥（MPK），它使用户空间进程能够以一种有效的方式切换域。虽然英特尔MPK的效率使开发人员能够将其用于代码指针完整性等常见用例，但有限数量的唯一域（16）禁止在需要大量域的情况下使用它，如OpenSSL。此外，英特尔MPK遭受保护密钥使用后免费漏洞。为了解决这些缺点，在本文中，我们提出了一种有效的RISC-V开放ISA的进程内隔离技术，称为SealPK，它支持多达1024个唯一域。SealPK通过利用惰性回收分配方法来防止保护键在免费后使用的问题。为了进一步加强SealPK，我们设计了三个新的密封特性，以保护已分配的域、它们的关联页面及其权限不被攻击者修改或篡改。为了证明我们设计的可行性，我们在RISC-V Rocket处理器上实现了SealPK，为其提供了操作系统支持，并在FPGA上对我们的设计进行了原型设计。我们通过利用SealPK在FPGA原型上实现孤立的阴影堆栈来展示其效率。
With the continuous increase in the number of software-based attacks, there has been a growing effort towards isolating sensitive data and trusted software components from untrusted third-party components. A hardware-assisted intra-process isolation mechanism enables software developers to partition a process into isolated components and in turn secure sensitive data from untrusted components. However, most of the existing hardware-assisted intra-process isolation mechanisms in modern processors, such as ARM and IBM Power, rely on costly kernel operations for switching between trusted and untrusted domains. Recently, Intel introduced a new hardware feature for intra-process memory isolation, called Memory Protection Keys (MPK), which enables a user-space process to switch the domains in an efficient way. While the efficiency of Intel MPK enables developers to leverage it for common use cases such as Code-Pointer Integrity, the limited number of unique domains (16) prohibits its use in cases such as OpenSSL where a large number of domains are required. Moreover, Intel MPK suffers from the protection key use-after-free vulnerability. To address these shortcomings, in this paper, we propose an efficient intra-process isolation technique for the RISC-V open ISA, called SealPK, which supports up to 1024 unique domains. SealPK prevents the protection key use-after-free problem by leveraging a lazy de-allocation approach. To further strengthen SealPK, we devise three novel sealing features to protect the allocated domains, their associated pages, and their permissions from modifications or tampering by an attacker. To demonstrate the feasibility of our design, we implement SealPK on a RISC-V Rocket processor, provide the OS support for it, and prototype our design on an FPGA. We demonstrate the efficiency of SealPK by leveraging it to implement an isolated shadow stack on our FPGA prototype.