IOSEC - Protection and Memory Safety for Input/Output Security

我们希望重新构建当前的计算机输入/输出（I/O）系统，将安全性作为一级设计约束。现有的I/O已经有机地发展了几十年，现在面临着安全漏洞的“完美风暴”，我们的目标是解决这个问题。今天的电脑充满了处理器：广告上的，隐藏的，甚至是无意的。处理器以嵌入式微控制器的形式隐藏在我们称为“无线卡”或“系统管理控制器”的“设备”中，但从根本上说，它们构成了一个异构的分布式系统。这些处理器运行的软件通常没有经过严格审查，可能是恶意软件。随着这个领域变得越来越明显，漏洞被发现的频率也越来越高。更糟糕的是，通过USB Type-C和Thunderbolt 3等接口的“可插拔”设备正成为趋势：用户正在接受培训，拿起处理器，认为它们是无害的，因为它们的形状像充电器或加密狗。例如，许多建筑物、飞机、火车和公共汽车现在都提供“USB充电”，但是，如果没有保护，Type-C用户可能会将自己暴露在意想不到的威胁中。这些威胁是企业、政府和消费者日益关注的重大问题。通过以安全性为核心重新设计I/O，我们的目标是大大改进当前的弱点。我们将调查当前I/O的弱点，并通过三个研究线索提出更安全的替代方案：1。我们将首先对当前硬件和软件设计中最先进的访问控制保护进行调查，以了解当前可插拔设备安全性的限制。我们将特别关注输入/输出内存管理单元（IOMMUs）的当前使用情况，这是防止设备具有无限直接内存访问（DMA）的主要当前防御措施-系统安全的“关键”，否则将允许恶意设备对固件，操作系统和应用程序进行全面危害。我们将描述当前安全性与性能之间的权衡，以建立性能基线。我们将系统化新的漏洞类别，并开发针对特定向量的攻击技术的语料库，未来的防御必须防止或减轻这些技术。我们现有的对现代操作系统中IOMMU使用情况的初步调查结果，以及越来越多的攻击文献，都表明存在重大的安全性和性能缺陷。因此，我们提出了两种研究方法来开发和评估防御基于I/ based攻击者的技术方法：许多I/O设备（例如，USB和网卡）通过DMA发送和接收的消息与主机操作系统通信。我们将开发新的技术来重组cpu到i /O互连，为不可信的设备提供基于消息的抽象，而不是依赖于DMA，这是目前（非常脆弱）的最佳实践。为了解决面向内存语义是固有的设备（例如，gpu和支持远程dma的网卡），我们将探索新的分布式内存保护技术，以避免面向iomu方法的粒度和性能限制。这将能够更好地控制设备对主机内存的访问，同时改善安全性和性能的权衡。例如，我们可以将特定的内存访问权限委托给设备，并通过互连桥接器强制执行策略和不可伪造性。所有研究将通过软硬件协同设计方法和FPGA原型进行，并对硬件和软件的性能、复杂性、兼容性和安全性指标进行评估。我们将与ARM公司密切合作实现这些目标，ARM公司提供了对行业需求和向商业技术过渡路径的关键见解。

We wish to re-architect current computer input/output (I/O) systems with security as a first-class design constraint. Existing I/O has evolved organically over the decades and now faces a 'perfect storm' of security vulnerabilities, which we aim to address.Computers today are full of processors: advertised, hidden and even unintentional. Processors, in the form of embedded microcontrollers, are hidden in 'devices' that we name as 'wireless card' or 'system management controller', but fundamentally they form a heterogenous distributed system. The software these processors run is often poorly scrutinised and may be actively malicious. As this field becomes more visible, vulnerabilities are being discovered with increasing frequency.Worse still, the trend is for 'pluggable' devices via interfaces such as USB Type-C and Thunderbolt 3: users are being trained to pick up processors, thinking they are innocuous because theyare shaped like chargers or dongles. For instance, many buildings, aircraft, trains and buses now provide 'USB charging', but, without protection, the Type-C user may be exposing themselves to unexpected threats. Such threats are of substantial and increasing concern to businesses, government and consumers. By redesigning I/O with security at the core, we aim to considerably improve on today's weaknesses. We will investigate the weaknesses of current I/O and propose safer alternatives through three threads of research:1. We will begin by performing a survey of the state-of-the-art of access-control protections in current hardware and software designs, to understand the limits of current pluggable-device security. We will focus in particular on current utilisation of Input/Output Memory Management Units (IOMMUs), which are the primary current defence that prevents devices from having unlimited Direct Memory Access (DMA) - the 'key to the kingdom' of system security that otherwise permits total compromise of firmware, OS, and applications from malicious devices. We will characterise current security-performance tradeoffs to establish a performance baseline. We will systemise new vulnerability classes and develop a corpus of vector-specific attack techniques which future defences must prevent or mitigate.Our existing preliminary results investigating IOMMU use in modern operating systems, and a growing attack literature, suggest substantial security and performance shortcomings. We therefore propose two strands of research to develop and evaluate technical approaches to defend against I/O-based attackers:2. Many I/O devices (e.g., USB and network cards) communicate with the host operating system through messages sent and received via DMA. We will develop new techniques to restructure CPU-to-I/O interconnects to provide a message-based abstraction for untrustworthy devices, rather than depending on DMA, as is current (and highly vulnerable) best practice.3. To address devices for which a memory-oriented semantic is intrinsic (e.g., GPUs and Remote-DMA enabled network cards), we will explore new distributed-memory protection techniques that avoid the granularity and performance limitations of IOMMU-oriented approaches. This will enable greater control of device access to host memory while improving security-performance tradeoffs. For instance we might delegate specific memory access rights to devices, with policy and unforgeability enforced by the interconnect bridges.All research will be performed via hardware-software co-design methodology and FPGA prototyping, with evaluation relative to performance, complexity, compatibility, and security metrics for both hardware and software. We will pursue these goals in close collaboration with ARM Ltd, who provide key insights into industry requirements and a transition path into commercial technologies.