Design and Verification of the Arm Confidential Compute Architecture
Design and Verification of the Arm Confidential Compute Architecture
复制标题
DOI：
--
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Xupeng Li;Xuheng Li;Christoffer Dall;Ronghui Gu;Jason Nieh;Yousuf Sait;Gareth Stockwell
中科院分区：
文献类型：
--
作者：
Xupeng Li;Xuheng Li;Christoffer Dall;Ronghui Gu;Jason Nieh;Yousuf Sait;Gareth Stockwell
在计算中越来越多地使用敏感的私人数据的同时，人们对数据隐私的担忧也越来越多。管理程序和操作系统等系统软件本应保护和隔离应用程序及其私有数据，但它们的大型代码库包含许多漏洞，可能会危及数据的机密性和完整性。我们引入了Realms，这是一种新的机密计算抽象，用于保护虚拟机的数据机密性和完整性。硬件为领域创造并实施了一个新的物理地址空间--领域世界。固件控制硬件以保护领域，并处理来自不受信任的系统软件的请求以管理领域，包括创建和运行领域。不受信任的系统软件保持对领域内存动态分配的控制，但不能访问领域内存内容，即使在更高的特权级别下运行也是如此。为了保证Realms的安全性，我们对固件进行了验证，引入了新颖的验证技术，使我们能够首次证明具有交接式锁定和动态分配共享页表的并发软件、在宽松内存硬件上运行的内核代码中的数据竞争、集成的C和ARM汇编代码相互调用以及不可信的软件完全控制系统资源分配的安全性和正确性。领域包括在ARM保密计算体系结构中。
The increasing use of sensitive private data in computing is matched by a growing concern regarding data privacy. System software such as hypervisors and operating systems are supposed to protect and isolate applications and their private data, but their large codebases contain many vulnerabilities that can risk data confidentiality and integrity. We introduce Realms, a new abstraction for confidential computing to protect the data confidentiality and integrity of virtual machines. Hardware creates and enforces Realm world, a new physical address space for Realms. Firmware controls the hardware to secure Realms and handles requests from untrusted system software to manage Realms, including creating and running them. Untrusted system software retains control of the dynamic allocation of memory to Realms, but cannot access Realm memory contents, even if run at a higher privileged level. To guarantee the security of Realms, we verified the firmware, introducing novel verification techniques that enable us to prove, for the first time, the security and correctness of concurrent software with hand-over-hand locking and dynamically allocated shared page tables, data races in kernel code running on relaxed memory hardware, integrated C and Arm assembly code calling one another, and untrusted software being in full control of allocating system resources. Realms are included in the Arm Confidential Compute Architecture.