SHF: Small: Architectural Support for Security in the Many-core Age: Threats and Opportunities

现代多核和多核架构有许多新的安全威胁。例如，共享的微架构组件（如缓存、核心互连网络和内存控制器）可以被用于侧通道攻击或拒绝服务攻击。利用显式并行性的工作负载的演变也可能导致额外的新威胁。可能会出现驻留在某些核心上并试图攻击其他应用程序的新形式的活跃病毒和木马。预测这种新形式的威胁并以一种有助于击败它们的方式设计多核心系统至关重要。如果不将安全性作为一阶设计原则，这些系统将极易受到攻击，导致巨大的金钱和生产力损失，以及事后对安全性进行改造的大量努力。该项目的总体主题是识别和分析在多核和多核环境中可能出现的安全威胁，并开发算法和技术，以复杂有效的方式解决这些威胁，同时不牺牲性能。特别感兴趣的是可以重用的技术和解决方案模式，以帮助应对不同的威胁。其中包括使用额外的内核和线程上下文来提供安全性，而不会造成显著的性能损失，以及开发共享资源的虚拟和物理隔离技术，以抵御侧通道攻击和拒绝服务攻击。此外，该项目还探索了在性能和安全性之间进行权衡的方法，并考虑了新内存技术的安全漏洞。

Modern multicore and manycore architectures have a number of new security threats. For example, shared microarchitecture components such as caches, core inter-connection networks, and memory controllers can be exploited for side-channel attacks or denial of service attacks. The evolution of workloads to exploit explicit parallelism will also likely lead to additional new threats. New forms of active viruses and trojans that reside on some cores and attempt to attack other applications are likely to arise. It is critical to anticipate such new forms of threats and design manycore systems in a manner that facilitates defeating them. If security is not treated as a first order design principle, these systems will be highly vulnerable to attacks, leading to enormous losses in money and productivity and a substantial effort to retrofit security in after the fact. The overall theme of this project is to identify and analyze security threats that can arise in a multicore and manycore environment and develop algorithms and techniques to address these threats in a complexity-effective manner and without sacrificing performance. Specific interest is on the techniques and solution patterns that can be reused to help with different threats. These include the use of additional cores and thread contexts to provide security without significant performance losses, and the development of techniques for virtual and physical isolation of shared resources to defend against sidechannel attacks and denial-of-service attacks. In addition, the project explores approaches for trading-off performance and security and also considers security vulnerabilities of new memory technologies.