基于ARM指针认证的信息流控制系统  

Information Flow Control System Based on ARM Pointer Authentication

作　　者：张立强[1] 陈青松 严飞[1] ZHANG Liqiang;CHEN Qingsong;YAN Fei(Key Laboratory of Aerospace Information Security and Trusted Computing,Ministry of Education,School of Cyber Science and Engineering,Wuhan University,Wuhan 430072,China)

机构地区：[1]武汉大学国家网络安全学院,空天信息安全与可信计算教育部重点实验室,湖北武汉430072

出　　处：《郑州大学学报（理学版）》2021年第3期42-49,共8页Journal of Zhengzhou University:Natural Science Edition

基　　金：国家自然科学基金项目(61272452);国家重点基础研究发展计划(973计划)项目(2014CB340601);湖北省重点研发计划项目(2020BAA003);苏州市前瞻性应用研究项目(SYG201845)。

摘　　要：为了解决物联网设备中的安全隔离和隐私数据泄露问题,对类Unix操作系统线程中的信息流控制进行研究,基于ARM指针认证的硬件安全扩展和分散式信息流控制模型,通过对线程添加安全标签和完整性标签,实现进程地址空间的细粒度安全隔离,内存共享保护和安全多线程;通过内核安全原语和安全检查钩子有效防止线程间未授权的数据访问。实验结果表明,基于硬件辅助的信息流控制系统可以获得显著的性能提升,原型系统在实际的物联网程序用例(OpenSSL和Apache HTTP服务器)中,运行时内存占用增加了210 kB,平均性能开销不超过3.66%。In order to solve the problems of security isolation and privacy data leakage in the internet of things(IoT)devices,the information flow control between the Unix-like operating system thread was studied.Based on the hardware security extension(ARM pointer authentication)and the decentralized information flow control(DIFC)model,the thread with security tags and integrity tags were labled,providing fine-grained security isolation within the process address space and protections of sharing memory and multithreading.Some security primitives and security check hooks were added in the kernel to prevent unauthorized data access between threads effectively.The evaluations showed that the hardware-assisted information flow control system could achieve significant performance improvement.And the prototype system induced a small memory footprint and runtime overhead in the practical IoT use case(the OpenSSL and Apache HTTP server).

关 键 词：指针认证 分散式信息流控制 线程标签 安全隔离 隐私保护 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]