IMPULP: A Hardware Approach for In-Process Memory Protection via User-Level Partitioning

doi:10.1007/s11390-020-9703-2

	IMPULP: A Hardware Approach for In-Process Memory Protection via User-Level Partitioning
	Zhao, Yang-Yang 1,2; Chen, Ming-Yu 1,2,3; Liu, Yu-Hang 1,2,3; Yang, Zong-Hao 1,2; Zhu, Xiao-Jing 1; Hong, Zong-Hui 2; Guo, Yun-Ge
	2020-03-01
发表期刊	JOURNAL OF COMPUTER SCIENCE AND TECHNOLOGY
ISSN	1000-9000
卷号	35 期号:2 页码:418-432
摘要	In recent years many security attacks occur when malicious codes abuse in-process memory resources. Due to the increasing complexity, an application program may call third-party code which cannot be controlled by programmers but may contain security vulnerabilities. As a result, the users have the risk of suffering information leakage and control flow hijacking. However, current solutions like Intel memory protection extensions (MPX) severely degrade performance, while other approaches like Intel memory protection keys (MPK) lack flexibility in dividing security domains. In this paper, we propose IMPULP, an effective and efficient hardware approach for in-process memory protection. The rationale of IMPULP is user-level partitioning that user code segments are divided into different security domains according to their instruction addresses, and accessible memory spaces are specified dynamically for each domain via a set of boundary registers. Each instruction related to memory access will be checked according to its security domain and the corresponding boundaries, and illegal in-process memory access of untrusted code segments will be prevented. IMPULP can be leveraged to prevent a wide range of in-process memory abuse attacks, such as buffer overflows and memory leakages. For verification, an FPGA prototype based on RISC-V instruction set architecture has been developed. We present eight tests to verify the effectiveness of IMPULP, including five memory protection function tests, a test to defense typical buffer overflow, a test to defense famous memory leakage attack named Heartbleed, and a test for security benchmark. We execute the SPEC CPU2006 benchmark programs to evaluate the efficiency of IMPULP. The performance overhead of IMPULP is less than 0.2% runtime on average, which is negligible. Moreover, the resource overhead is less than 5.5% for hardware modification of IMPULP.
关键词	in-process isolation memory protection out-of-bounds user-level partitioning
DOI	10.1007/s11390-020-9703-2
收录类别	SCI
语种	英语
资助项目	National Key Research and Development Plan of China[2016YFB1000200] ; National Natural Science Foundation of China[61772497] ; State Key Laboratory of Computer Architecture Foundation[CARCH4405] ; State Key Laboratory of Computer Architecture Foundation[CARCH2601]
WOS研究方向	Computer Science
WOS类目	Computer Science, Hardware & Architecture ; Computer Science, Software Engineering
WOS记录号	WOS:000534804000017
出版者	SCIENCE PRESS
引用统计	被引频次：1[WOS] [WOS记录] [WOS相关记录]
文献类型	期刊论文
条目标识符	http://119.78.100.204/handle/2XEOYT63/15337
专题	中国科学院计算技术研究所期刊论文_英文
通讯作者	Chen, Ming-Yu
作者单位	1.Chinese Acad Sci, Inst Comp Technol, State Key Lab Comp Architecture, Beijing 100190, Peoples R China 2.Univ Chinese Acad Sci, Beijing 10049, Peoples R China 3.PengCheng Lab, Shenzhen 518055, Peoples R China
推荐引用方式 GB/T 7714	Zhao, Yang-Yang,Chen, Ming-Yu,Liu, Yu-Hang,et al. IMPULP: A Hardware Approach for In-Process Memory Protection via User-Level Partitioning[J]. JOURNAL OF COMPUTER SCIENCE AND TECHNOLOGY,2020,35(2):418-432.
APA	Zhao, Yang-Yang.,Chen, Ming-Yu.,Liu, Yu-Hang.,Yang, Zong-Hao.,Zhu, Xiao-Jing.,...&Guo, Yun-Ge.(2020).IMPULP: A Hardware Approach for In-Process Memory Protection via User-Level Partitioning.JOURNAL OF COMPUTER SCIENCE AND TECHNOLOGY,35(2),418-432.
MLA	Zhao, Yang-Yang,et al."IMPULP: A Hardware Approach for In-Process Memory Protection via User-Level Partitioning".JOURNAL OF COMPUTER SCIENCE AND TECHNOLOGY 35.2(2020):418-432.