Flexible hardware-managed isolated execution: Architecture, software support and applications
Author | Evtyushkin D. |
Author | Elwell J. |
Author | Ozsoy M. |
Author | Ponomarev D. |
Author | Ghazaleh N.A. |
Author | Riley R. |
Available date | 2019-10-06T09:38:36Z |
Publication Date | 2018 |
Publication Name | IEEE Transactions on Dependable and Secure Computing |
Resource | Scopus |
ISSN | 1545-5971 |
Abstract | We consider the problem of how to provide an execution environment where the application's secrets are safe even in the presence of malicious system software layers. We propose Iso-X- A flexible, fine-grained hardware-supported framework that provides isolation for security-critical pieces of an application such that they can execute securely even in the presence of untrusted system software. Isolation in Iso-X is achieved by creating and dynamically managing compartments (isolated software modules) to host critical fragments of code and associated data. Iso-X provides fine-grained isolation at the memory-page level, flexible allocation of memory, and a low-complexity, hardware-only trusted computing base. Iso-X requires minimal additional hardware, a small number of new ISA instructions to manage compartments, and minimal changes to the operating system which need not be in the trusted computing base. The run-time performance overhead of Iso-X is negligible and even the overhead of creating and destroying compartments is modest. An FPGA implementation of Iso-X runtime mechanisms shows a negligible impact on the processor cycle time. 2004-2012 IEEE. |
Sponsor | This publication was made possible by the support of the NPRP grant 4-1593-1-260 from the Qatar National Research Fund. The statements made herein are solely the responsibility of the authors. |
Language | en |
Publisher | Institute of Electrical and Electronics Engineers Inc. |
Subject | hardware security isolated execution Security |
Type | Article |
Pagination | 437-451 |
Issue Number | 3 |
Volume Number | 15 |
Files in this item
Files | Size | Format | View |
---|---|---|---|
There are no files associated with this item. |
This item appears in the following Collection(s)
-
Computer Science & Engineering [2288 items ]