CAPcelerate: Capabilities for Heterogeneous Accelerators

该项目旨在扩展CHERI计算机处理器架构提供的硬件安全能力，以涵盖“加速器”-旨在加速特定专业任务的硬件。今天，加速器的构造方式与通用处理器不同，并且越来越多地可以根据需要插入计算机（例如通过Thunderbolt连接）。我们希望架构新的方式，加速器可以安全地与计算机系统进行通信，考虑到如果加速器或其软件是由一个不值得信赖的代理设计的，或恶意软件加载到it. Such保护将提供整个系统的安全性，以最新的计算系统依赖于加速器的性能操作。它还将使用户能够将加速器添加到他们的系统安全中，因为他们知道他们不会向安全漏洞开放。作为该项目的一部分，我们将构建加速器的软件和硬件模型，并评估潜在的安全和性能保护，旨在设计高效和安全的保护机制。

This project seeks to extend the capability hardware security provided by the CHERI computer processor architecture to cover 'accelerators' - hardware designed for speeding up particular specialised tasks. Today accelerators are constructed in a different way to general-purpose processors and increasingly they can be plugged into computers as needed (for instance via a Thunderbolt connection). We wish to architect new ways in which accelerators may communicate with computer systems safely, considering if the accelerator or its software were designed by an untrustworthy agent, or malicious software were loaded on to it. Such protection would provide whole-system security to most current computing systems which depend on accelerators for performant operation. It would also enable users to add accelerators to their system safe in the knowledge that they are not opening themselves up to security vulnerabilities. As part of this project we will build software and hardware models of accelerators and evaluate potential protections for security and performance, aiming to design efficient and secure protection mechanisms.