Memory protection for system software isolation

内存漏洞一直是系统安全中反复出现的挑战。攻击的目标是系统堆栈(例如操作系统内核和固件)中越来越低的抽象级别，这是用户空间所依赖的信任根。这个PHD的目标是调查和评估在较低级别实现内存安全的不同方法，以确保安全和隔离的堆栈，进而确保更值得信任的用户空间。一种这样的方法是利用内存安全语言，如Rust，它利用其所有权模型将所有者分配给作用域中的所有值，从而促进内存地址的安全引用和取消引用。另一种方法是利用新的硬件指令集体系结构(ISA)扩展。例如，Cheri，一种用于RISC体系结构的混合功能ISA扩展。它通过将传统的ISA和内存管理单元(MMU)设计选择与功能系统模型相结合，实现了硬件中的故障隔离。在系统堆栈的不同级别上执行软件时，根据最小特权和有意使用的原则，CHERI功能可以实现细粒度的内存保护，从而防止和减轻漏洞。最后，到目前为止的初步工作探索了x86 ISA扩展的使用，以Intel的内存保护扩展(MPX)的形式来保护可信执行环境(TEE)中的系统软件。我们将探讨这样的方法，无论是单独的还是组合的，都可以预防和减轻安全关键系统软件中的漏洞

Memory vulnerabilities have been a recurrent challenge in systems security. Exploits are targeting increasingly lower levels of abstraction in the system stack (e.g. the OS kernel and firmware), the root of trust on which the user space relies. The goal of this PhD is to investigate and evaluate different approaches to achieving memory safety at a lower level in order to ensure a secure and isolated stack and in turn a more trustworthy user space. One such approach is to leverage memory safe languages such as Rust, which takes advantage of its ownership model to assign an owner to all values in scope, and hence facilitate safe referencing and dereferencing of memory addresses. Another approach is to leverage new hardware Instruction Set Architecture (ISA) extensions. For instance CHERI, a hybrid capability ISA extension for RISC architectures. It enables fault isolation in hardware by combining conventional ISA and Memory Management Unit (MMU) design choices with a capability-system model. CHERI capabilities enable fine-grained memory protection based on the principles of least privilege and intentional use in the execution of software at different levels of the system stack, hence preventing and mitigating vulnerabilities. Finally, initial work so far has explored the use of x86 ISA extension, in the form of Intel's memory protection extensions (MPX), to protect system software inside trusted execution environments (TEEs). We will explore the thesis that such approaches, both individually and in combination, can prevent and mitigate vulnerabilities in security-critical system software