2018年安全处理器架构设计原则：产业趋势与实践

需积分: 12 121 浏览量更新于2024-07-18 1 收藏 3.26MB PDF 举报

《安全处理器架构设计原则》是2018年出版的一本专著，由Princeton University的Margaret Martonosi教授和University of Wisconsin-Madison的Mark D. Hill教授共同编辑，作为Synthesis Lectures on Computer Architecture系列的一部分。该系列专注于计算机体系结构的设计、分析、选择和互联硬件组件，旨在满足功能、性能和成本目标。它主要涵盖了顶级计算机架构会议如ISCA、HPCA、MICRO和ASPLOS的研究视角。随着计算机安全领域日益增长的关注，以及对运行在普通计算机上的代码和数据保护的需求提升，近年来处理器中的安全特性显著增加。不再是纯粹的学术话题，安全功能已被工业界广泛采纳，现今市场上已经出现了多种商业级的安全处理器架构。《安全处理器架构设计原则》这本书详细探讨了这一领域的核心原理，为设计者提供了关于如何构建安全处理器的实用指导。书中作者Jakub Szefer对安全处理器架构进行了深入研究，涉及到了处理器设计中的安全策略和技术。他的工作可能包括了对硬件信任根、加密算法、隔离机制以及抵御攻击的措施等方面进行探讨，以确保在处理敏感信息时系统的安全性。与此同时，书中的其他作品如《通用图形处理器架构》、《异构系统编译算法》和《虚拟内存的体系结构与操作系统支持》也反映了计算机体系结构的多元化发展，涵盖了图形处理单元设计、针对不同硬件环境优化算法的方法，以及虚拟内存管理技术的进步。《深度学习对于计算机架构师的意义》则展示了深度学习技术如何影响现代处理器设计决策，以及如何将其整合到硬件设计中以提高性能和效率。总体而言，《Principles of Secure Processor Architecture Design 2018》是一本涵盖了当前处理器安全设计的关键趋势和实践的综合性资源，为读者提供了宝贵的知识，无论是对学术研究还是工业界实践都具有重要的参考价值。通过深入理解这些原则，设计者可以更好地应对安全挑战，确保在现代计算环境中提供可靠和安全的服务。

xvi

5.2 Chain of Trust and Measurements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56

5.2.1 Trusted and Authenticated Boot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57

5.2.2 Measurement Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

5.2.3 Remote Attestation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

5.2.4 Sealing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59

5.2.5 Time-of-Check to Time-of-Use Attacks. . . . . . . . . . . . . . . . . . . . . . . . 60

5.3 Runtime Attestation and Continuous Monitoring of TCB and TEEs . . . . . . 60

5.3.1 Limitations of Continuous Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . 61

5.4 PUFs and Root of Trust . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

5.4.1 Hardware-Software Binding . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61

5.5 Limiting Execution to Only Authorized Code . . . . . . . . . . . . . . . . . . . . . . . . . 62

5.5.1 Lock-in and Privacy Concerns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

5.6 Root of Trust Assumptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

5.6.1 Unique of Root of Trust Key Assumption . . . . . . . . . . . . . . . . . . . . . . . 63

5.6.2 Protected Root of Trust Assumption . . . . . . . . . . . . . . . . . . . . . . . . . . . 63

5.6.3 Fresh Measurement Assumption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

Memory Protections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

6.1 reats Against Main Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

6.1.1 Sources of Attacks on Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65

6.1.2 Passive Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

6.1.3 Active Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66

6.2 Main Memory Protection Mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

6.2.1 Conﬁdentiality Protection with Encryption . . . . . . . . . . . . . . . . . . . . . . 68

6.2.2 Integrity Protection with Hashing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70

6.2.3 Access Pattern Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

6.3 Memory Protections Assumption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74

6.3.1 Encrypted, Hashed, and Oblivious Access Memory Assumption . . . . 74

Multiprocessor and Many-Core Protections . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

7.1 Security Challenges of Multiprocessors and Many-Core Systems . . . . . . . . . . 75

7.2 Multiprocessor Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

7.2.1 SMP and DSM reat Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

7.2.2 Symmetric Memory Multiprocessor Security . . . . . . . . . . . . . . . . . . . . 77

7.2.3 Distributed Shared Memory Security . . . . . . . . . . . . . . . . . . . . . . . . . . 79

7.2.4 SMP and DSM Tradeoﬀs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

7.3 Many-Core Processors and Multi-Processor System-on-a-Chip . . . . . . . . . . . 81

xvii

7.3.1 Many-Core and MPSoC reat Model . . . . . . . . . . . . . . . . . . . . . . . . . 81

7.3.2 Communication Protection Mechanisms . . . . . . . . . . . . . . . . . . . . . . . . 82

7.3.3 3D Integration Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83

7.4 Multiprocessor and Many-Core Protections Assumption . . . . . . . . . . . . . . . . 84

7.4.1 Protected Inter-Processor Communication Assumption . . . . . . . . . . . . 84

Side-Channel reats and Protections . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

8.1 Side and Covert Channels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

8.1.1 Covert Channel Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

8.1.2 Side Channel Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86

8.1.3 Side and Covert Channels in Processors . . . . . . . . . . . . . . . . . . . . . . . . 87

8.2 Processor Features and Information Leaks . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88

8.2.1 Variable Instruction Execution Timing . . . . . . . . . . . . . . . . . . . . . . . . . 89

8.2.2 Functional Unit Contention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90

8.2.3 Stateful Functional Units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

8.2.4 Memory Hierarchy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

8.2.5 Physical Emanations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

8.3 Side and Covert Channel Classiﬁcation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94

8.4 Estimates of Existing Attack Bandwidths . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

8.4.1 Attack Bandwidth Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

8.5 Defending Side and Covert Channels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

8.5.1 Hardware-Based Defenses Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 98

8.5.2 Secure Cache Designs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100

8.5.3 Software-Based Defenses . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

8.5.4 Combining Defenses Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

8.6 Side Channels as Attack Detectors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

8.7 Side-Channel reats Assumption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

8.7.1 Side-Channel Free TEE Assumption . . . . . . . . . . . . . . . . . . . . . . . . . 102

Security Veriﬁcation of Processor Architectures . . . . . . . . . . . . . . . . . . . . . . . . 103

9.1 Motivation for Formal Security Veriﬁcation . . . . . . . . . . . . . . . . . . . . . . . . . . 103

9.2 Security Veriﬁcation across Diﬀerent Levels of Abstraction . . . . . . . . . . . . . 104

9.3 Security Veriﬁcation Approaches . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105

9.3.1 System Representation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

9.3.2 Security Properties . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107

9.3.3 Formal Veriﬁcation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

9.4 Discussion of Hardware-Software Security Veriﬁcation Projects . . . . . . . . . . 109

xix

Preface

Recent years have brought increased interest in hardware security features that can be added to

computer processors to protect sensitive code and data. It has been realized that new hardware

security features can be used to provide, for example, means of authentication or protection of

conﬁdentiality and integrity. e hardware oﬀers a very high level of immutability, helping to

ensure that it is diﬃcult to change the hardware security protections (unlike with software-only

protections). Hardware cannot be as easily bypassed or subverted as software, as it is the ultimate

lowest layer of a computer system. Finally, dedicated hardware for providing security protections

can potentially oﬀer energy eﬃciency and minimal impact on system performance.

Yet, adding security features in hardware has many challenges. Deﬁning what has to be

secured, and how, is often a subjective choice based on qualitative arguments—unlike the quan-

titative choices that computer architects are used to making. Moreover, once made, the hardware

cannot be easily changed, which necessitates careful design of the security features in the ﬁrst

place. e secure architecture design process also requires foresight to include features and al-

gorithms that will be suitable for many years to come. Perhaps the biggest challenges are the

attacks and various information leaks that the system should protect against. Not only random

errors or faults need to be considered, but the system also needs to defend against “smart” at-

tackers who can intelligently manipulate inputs or probe the hardware to try to maximize their

chances of subverting the computer system’s protections.

is book assumes readers may be at the level of a ﬁrst- or second-year graduate student

in computer architecture. e book is also suitable for more senior students or for practicing

computer architects who are interested in starting work on the design of secure processor ar-

chitectures. e book provides a chapter on security topics such as encryption, hashing, conﬁ-

dentiality, and integrity, to name a few—consequently a background in computer security is not

required. It is the hope that this book will get computer architects excited about security and

help them work on secure processor architectures.

e chapters of this book are based on research ideas developed by the author and also

ideas gleaned from papers that a variety of researchers have presented in conferences such as

ISCA, ASPLOS, HPCA, CCS, S&P, and Usenix Security. Information is also included about

recent commercial architectures, such as Intel SGX, ARM TrustZone, and AMD memory en-

cryption technologies. e book, however, is not meant as a manual or tutorial about any one

speciﬁc security architecture. Rather, it uses past academic and industry research to derive and

present the principles behind design of such secure processor architectures.

is book is divided into ten chapters. Chapter 1 focuses on motivating the need for

secure processor architectures and gives an overview of the book’s organization. Chapter 2 covers

剩余172页未读，继续阅读

ddalecn

粉丝: 8
资源: 31

2018年安全处理器架构设计原则：产业趋势与实践

Principles of Secure Processor Architecture Design_2018.pdf

Conventional_Beamforming.m

general purpose GPU design

principles of cmos vlsi design 2nd edition

patterns, principles, and practices of domain-driven design mobi pdf

rudin principles of mathematical analysis 下载

principles of neural science

levinson h j.overlay//principles of lithography,spie,2005.

ant-design-vue

principles of lasers 下载

最新资源