Draco: Architectural and Operating System Support for System Call Security
Draco: Architectural and Operating System Support for System Call Security
复制标题
DOI：
10.1109/micro50266.2020.00017
复制
发表时间：
2020-10
期刊：
影响因子：
--
通讯作者：
Dimitrios Skarlatos;Qingrong Chen;Jianyan Chen;Tianyin Xu;J. Torrellas
中科院分区：
文献类型：
--
作者：
Dimitrios Skarlatos;Qingrong Chen;Jianyan Chen;Tianyin Xu;J. Torrellas
系统调用检查被广泛用于保护操作系统内核免受用户攻击。但是，现有的解决方案（如Seccomp）针对系统调用及其参数执行冗长的基于规则的检查程序，从而导致大量的执行开销。为了最小化检查开销，本文提出了Draco，这是一种新的架构，可以在系统调用id和参数值经过检查和验证后缓存它们。系统调用首先在一个特殊的缓存中查找，并在命中时跳过所有检查。我们给出了Draco的软件和硬件实现。后者引入了一个系统调用暂存缓冲区（SLB）来保存最近验证的系统调用，以及一个系统调用目标缓冲区来提前预加载SLB。在我们的评估中，我们发现使用常规Seccomp检查的宏观和微观基准测试的平均执行时间分别比不执行安全检查的不安全基准测试高1.14倍和1.25倍。使用我们的软件Draco，平均执行时间分别比不安全基线高1.10倍和1.18倍。使用我们的硬件Draco，执行时间在不安全基线的1%以内。
System call checking is extensively used to protect the operating system kernel from user attacks. However, existing solutions such as Seccomp execute lengthy rule-based checking programs against system calls and their arguments, leading to substantial execution overhead.To minimize checking overhead, this paper proposes Draco, a new architecture that caches system call IDs and argument values after they have been checked and validated. System calls are first looked-up in a special cache and, on a hit, skip all checks. We present both a software and a hardware implementation of Draco. The latter introduces a System Call Lookaside Buffer (SLB) to keep recently-validated system calls, and a System Call Target Buffer to preload the SLB in advance. In our evaluation, we find that the average execution time of macro and micro benchmarks with conventional Seccomp checking is 1.14× and 1.25× higher, respectively, than on an insecure baseline that performs no security checks. With our software Draco, the average execution time reduces to 1.10× and 1.18× higher, respectively, than on the insecure baseline. With our hardware Draco, the execution time is within 1% of the insecure baseline.