CAPcelerate: Capabilities for Heterogeneous Accelerators

该项目旨在扩展由Cheri计算机处理器架构提供的功能硬件安全，以涵盖“加速器”--专为加速特定特定任务而设计的硬件。如今，加速器的构造方式与通用处理器不同，越来越多的加速器可以根据需要插入计算机(例如，通过迅雷连接)。考虑到加速器或其软件是由不可信的代理设计的，还是恶意软件加载到加速器上，我们希望设计新的加速器与计算机系统安全通信的方式。这种保护将为大多数依赖加速器执行操作的当前计算系统提供全系统安全。它还将使用户能够将加速器添加到他们的系统安全中，因为他们知道自己不会让自己面临安全漏洞。作为该项目的一部分，我们将建立加速器的软件和硬件模型，并评估潜在的安全保护和性能保护，旨在设计高效和安全的保护机制。

This project seeks to extend the capability hardware security provided by the CHERI computer processor architecture to cover 'accelerators' - hardware designed for speeding up particular specialised tasks. Today accelerators are constructed in a different way to general-purpose processors and increasingly they can be plugged into computers as needed (for instance via a Thunderbolt connection). We wish to architect new ways in which accelerators may communicate with computer systems safely, considering if the accelerator or its software were designed by an untrustworthy agent, or malicious software were loaded on to it. Such protection would provide whole-system security to most current computing systems which depend on accelerators for performant operation. It would also enable users to add accelerators to their system safe in the knowledge that they are not opening themselves up to security vulnerabilities. As part of this project we will build software and hardware models of accelerators and evaluate potential protections for security and performance, aiming to design efficient and secure protection mechanisms.