Mitigating Software Vulnerabilities with Architectural Support for Type-safety

点击翻译按钮获取中文摘要

Security vulnerabilities occur in because of software defects (i.e. bugs) created by programmers. The defects, if triggered by an attacker, result in unintended functionality in a program. In the worst case, these defects may allow an attacker to corrupt values in program memory in a controlled way. Previous security solutions concentrate largely on software-only approaches, which can easily impose as much as 87% performance overhead. Recent attempts to provide architectural hardware support for security have been less than spectacular. Intel MPX provides hardware bounds checking of memory accesses. While MPX provides better security guarantees than software-only solutions, it performs no better, still imposing anywhere from 20-400% performance overhead. The proposed research will seek to devise and evaluate integrated hardware/software security support in central processing units (CPUs) with an aim of imposing less than 5% overhead. By tightly integrating the software and hardware components of the solution we propose a) software tools that generate code in a way that is easier for hardware to protect against attack and b) hardware that utilizes mechanisms such as caching and pre-fetching to accelerate the protection operations.