🤖 AI Summary
Existing hardware and software defenses against fine-grained memory-access vulnerabilities (e.g., out-of-bounds access, ROP attacks) stemming from third-party code struggle to simultaneously achieve strong security, low overhead, and broad portability.
Method: This paper proposes a dynamic in-process address-space isolation mechanism that enables multi-privilege, programmable security domains within a single virtual address space—ensuring end-to-end protection for both data and control flows while supporting secure system calls. It introduces the first “dynamically code-segment-driven” isolation architecture, overcoming limitations of static partitioning in granularity, performance cost, and compatibility. The design integrates a custom secure processor microarchitecture (FPGA prototype), QEMU-based simulation, compiler-assisted tagging, and runtime monitoring.
Results: Evaluation demonstrates robust resilience against representative memory corruption attacks, with average hardware overhead under 8%—significantly outperforming pure-software approaches—while preserving binary compatibility.
📝 Abstract
In the existing software development ecosystem, security issues introduced by third-party code cannot be overlooked. Among these security concerns, memory access vulnerabilities stand out prominently, leading to risks such as the theft or tampering of sensitive data. To address this issue, software-based defense mechanisms have been established at the programming language, compiler, and operating system levels. However, as a trade-off, these mechanisms significantly reduce software execution efficiency. Hardware-software co-design approaches have sought to either construct entirely isolated trusted execution environments or attempt to partition security domains within the same address space. While such approaches enhance efficiency compared to pure software methods, they also encounter challenges related to granularity of protection, performance overhead, and portability. In response to these challenges, we present the DASICS (Dynamic in-Address-Space Isolation by Code Segments) secure processor design, which offers dynamic and flexible security protection across multiple privilege levels, addressing data flow protection, control flow protection, and secure system calls. We have implemented hardware FPGA prototypes and software QEMU simulator prototypes based on DASICS, along with necessary modifications to system software for adaptability. We illustrate the protective mechanisms and effectiveness of DASICS with two practical examples and provide potential real-world use cases where DASICS could be applied.
