TWC: Medium: HARDWARE-ASSISTED LIGHTWEIGHT CAPABILITY OPTIMIZATION (HALCYON)

为了应对当今不断面临的安全挑战和网络威胁，硬件辅助轻量级能力优化（HALCYON）研究探索了新技术，以使用户能够接受更安全的系统设计性能。传统的系统设计已经实现了可接受的性能，但是已经从硬件和软件设计演变而来，这些设计在过去对安全性进行了妥协，但在当今的安全环境中不适合现代硬件资源。HALCYON采用了一种被称为“能力”的方法，它可以比现在的架构更好地控制计算机系统中的信息共享和保护。能力访问控制是许多安全专家的首选，但传统观点认为它在实践中使用太慢。如果HALCYON成功，新一代更安全的软件系统将被启用，而性能上几乎没有成本。HALCYON研究在基于功能的面向对象程序员控制的保护模型中，探索了使用每个对象访问控制的选定操作的硬件加速。测量和数据驱动的探索是基于对移动电话和其他设备中使用的微内核（如L4）上硬件加速的定量好处的理解。硬件加速的例子包括对脂肪指针（“低脂肪指针”）的轻量级支持，以及具有相关访问控制规范的对象指针。这种已被设计、验证和实现的胖指针可以保护小到单个存储字的单元。作为最初的例子，该项目正在使用度量来确定这种硬件加速的影响。来自定量探索的测量数据使研究人员能够确定有价值的硬件加速和利用这些加速进行操作系统重构的机会。

To address today's environment of constant security challenges and cyber-threats, the Hardware-Assisted Lightweight Capability Optimization (HALCYON) research explores novel techniques to make the performance of more secure system designs acceptable to users. Conventional system designs have achieved acceptable performance, but have evolved from hardware and software designs that carry forward compromises in security that made sense in the past, but not with modern hardware resources in today's security climate. HALCYON uses an approach, called "capabilities", that provides better control of information sharing and protection in computer systems than today's architectures. Capability access control is preferred by many security experts, but conventional wisdom holds that it is too slow to be used in practice. If HALCYON is successful, a new generation of fundamentally more secure software systems will be enabled, at little to no cost in performance. HALCYON research explores hardware acceleration of selected operations in the use of per-object access controls in an object-oriented programmer-controlled protection model based on capabilities. The measurement and data driven exploration is based on understanding the quantitative benefits of hardware acceleration on microkernels such as L4 that are used in mobile phones and other devices. Examples of hardware accelerations include lightweight support for fat pointers ("low-fat pointers"), object pointers with associated access control specifications. Such fat pointers, which have been designed, validated and implemented, can protect units as small as individual memory words. As an initial example, the project is using measurements to identify the impact of this hardware acceleration. Measurement data from the quantitative exploration allows the researchers to identify both worthwhile hardware accelerations and opportunities for operating system restructuring that exploit those accelerations.