Hardware Assisted Buffer Protection Mechanisms for Embedded RISC-V
Hardware Assisted Buffer Protection Mechanisms for Embedded RISC-V
复制标题
DOI：
10.1109/tcad.2020.2984407
复制
发表时间：
2020-12
影响因子：
2.9
通讯作者：
Asmit De;Aditya Basu;Swaroop Ghosh;T. Jaeger
中科院分区：
文献类型：
--
作者：
Asmit De;Aditya Basu;Swaroop Ghosh;T. Jaeger
RISC-V是一种很有前途的开源架构，主要针对低功耗嵌入式设备和片上系统（soc）。然而，在RISC-V架构中缺乏实用且低开销的安全解决方案。使用RISC-V工具链编译的程序仍然容易受到代码注入和代码重用攻击，例如缓冲区溢出和面向返回的编程（ROP）。在本文中，我们提出了两个硬件实现的RISC-V安全扩展，它们提供了针对此类攻击的防御机制。我们首先采用了一种基于物理不可克隆函数（PUF）的随机金丝雀生成技术，该技术消除了将敏感金丝雀词存储在内存或CPU寄存器中的需要，因此更安全，同时产生较低的开销。我们在RISC-V RocketChip上使用火箭定制协处理器（RoCC）实现了所提出的金丝雀引擎。仿真结果表明，使用单个缓冲区保护时，平均执行开销为2.2%，而当保护扩展到所有缓冲区时，缓冲区计数增加10倍仅增加开销1.5倍。我们通过在RoCC上实现的嵌入式RISC-V （FIXER）专用安全协处理器流完整性扩展进一步改进了这一点。FIXER强制在后边缘（返回）和前边缘（调用）上运行程序的细粒度控制流完整性（CFI），而不需要对处理器核心进行任何架构修改。与基于软件的解决方案相比，FIXER以最小的执行时间（1.5%）和面积（2.9%）开销减少了60%的能源开销。
RISC-V is a promising open-source architecture that targets low-power embedded devices and system-on-chips (SoCs). However, there is a dearth of practical and low-overhead security solutions in the RISC-V architecture. Programs compiled using RISC-V toolchains are still vulnerable to code injection and code reuse attacks, such as buffer overflow and return-oriented programming (ROP). In this article, we propose two hardware-implemented security extensions to RISC-V that provides a defense mechanism against such attacks. We first employ a physically unclonable function (PUF)-based randomized canary generation technique that removes the need to store the sensitive canary words in memory or CPU registers, thereby being more secure, while incurring low overheads. We implement the proposed Canary Engine in RISC-V RocketChip with rocket custom coprocessor (RoCC). The simulation results show 2.2% average execution overhead with a single buffer protection, while a $10\times $ increase in buffer count only increases the overhead by $1.5\times $ when protection is extended to all buffers. We further improve upon this with a dedicated security coprocessor flow integrity extensions for embedded RISC-V (FIXER), implemented on the RoCC. FIXER enforces fine-grained control-flow integrity (CFI) of running programs on backward edges (returns) and forward edges (calls) without requiring any architectural modifications to the processor core. Compared to software-based solutions, FIXER reduces energy overhead by 60% at minimal execution time (1.5%) and area (2.9%) overheads.