A Computer Architecture for Expressive Security

Abstract:

The computer architecture plays an important role in system security. A prevalent approach to addressing security challenges in computer systems is through architecture extensions designed for specific security goals. However, this patchwork strategy can restrict the expressiveness and performance that applications demand. For example, we found the exception handling mechanism of Intel SGX vulnerable to our proposed SmashEx attack, which enables arbitrary code execution in protected enclaves. We also found enclaved TEEs (trusted execution environments) like Intel SGX incur prohibitive overheads for cross-enclave memory sharing.

We observe a tension between the decades-old architecture paradigm, characterised by fixed privilege hierarchies and centralised security policies, and modern applications, which demand support for trust models involving mutual distrust, fine-grained and temporally varying policies, and extensible hierarchies. The patchwork approach seeks ad hoc mechanisms to support these new demands, but is limited by its unchanged core assumptions.

In light of these limitations, this thesis takes an alternative approach: it rethinks computer architecture from first principles to fulfil the diverse security goals that modern applications require. The result is a computer architecture called Capstone. The main part of this thesis focuses on the design, use cases, and implementation of Capstone.

The core of Capstone adopts the principle of capability-based security: authority, such as permission to access memory regions, rests on possession of capability tokens rather than on privilege levels or centrally defined policies. Capabilities in existing capability-based architectures do not support mutual distrust or revocable resource delegation, thereby falling short of satisfying modern application demands. Capstone supports these features by extending the base capability model with additional capability types with special semantics. Another challenge is to provide compatibility with existing virtual-memory-based software while maintaining the strengths of capability-based isolation. We propose a general approach called caplification to achieve this. With caplification, Capstone supports running an unmodified Linux software stack alongside capability-aware software while allowing them to interoperate through capability-based memory sharing.

Capstone enables use cases that are challenging for existing architectures. This thesis discusses two such examples. One is nestable enclave isolation with fine-grained and revocable memory sharing. Each isolated software domain may create a new domain and delegate part of its own resources to the new domain. The nesting can occur at any level, and delegated resources can be revoked at any later time. The isolation between parent and child domains is by default two-way. The child domain, in particular, does not need to trust the parent for data confidentiality and integrity in the delegated memory regions. In the second example use case, Capstone capabilities help enforce Rust pointer lifetime and aliasing principles in foreign code. We have successfully used a software prototype to find previously unknown bugs in real-world mixed-language Rust projects.

We have built a prototype implementation of Capstone as instantiated on RISC-V, including both hardware and a software stack. The resulting hardware-software system is fully functional and has been tested on FPGA. As the thesis will discuss, Capstone creates both new opportunities and challenges in the implementation, and we expect this first prototype implementation to serve as a basis for future investigations in these areas. An important question in our hardware implementation effort is how to avoid bugs in the RTL (register transfer level) design and ease the burden of verification. To this end, we have created Anvil, a hardware description language (HDL) that prevents a common class of bugs, which we call timing hazards, with a novel type system. While initially motivated by Capstone’s implementation effort, Anvil is designed to be general-purpose, and we expect Anvil to be useful in other hardware projects as well. We have publicly released both Capstone and Anvil implementations at https://capstone.kisp-lab.org/ and https://anvil.kisp-lab.org/.