RISC-V架构硬件辅助用户态内存安全防御方案概览  

Summary of Hardware-assisted User-mode Memory Safety Defenses on RISC-V Architechture

作　　者：解达 欧阳慈俨 宋威 XIE Da;OUYANG Ci-Yan;SONG Wei(State Key Laboratory of Information Security,Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100195,China;School of Cyber Security,University of Chinese Academy of Sciences,Beijing 101408,China)

机构地区：[1]中国科学院、信息工程研究所、信息安全国家重点实验室,北京100195 [2]中国科学院大学、网络空间安全学院,北京101408

出　　处：《计算机系统应用》2023年第11期11-20,共10页Computer Systems & Applications

基　　金：国家自然科学基金(61802402,62172406);中国科学院率先行动“百人计划”青年俊才(C类)。

摘　　要：传统的用户态内存安全防御机制基于x86架构和纯软件方式实现,实现内存安全保护的运行时开销很高,难以部署在生产环境中.近年来,随着主流商业处理器开始提供硬件安全扩展,以及RISC-V等开源处理器架构的兴起,内存安全保护方案开始面向x86-64、ARM、RISC-V等多种体系架构和硬件辅助实现方式.我们对RISC-V架构上实现的内存安全防御方案进行了讨论,并对x86-64、ARM、RISC-V等处理器架构在安全方案设计上的特点进行了比较.得益于开放的指令集架构生态,RISC-V架构的内存安全防御方案相较于其他架构有一些优势.一些低成本的安全防御技术有望在RISC-V架构上实现.Traditional x86-based and software-based user-mode memory safety defenses can hardly be deployed in a production-ready environment due to significant runtime overheads.In recent years,as mainstream commercial processors begin to provide hardware security extensions and open-source architectures like RISC-V rise,hardware-assisted memory safety protections have become popular,and their implementations are based on various architectures,such as x86-64,ARM,and RISC-V.This study discusses user-mode memory safety defenses on the RISC-V architecture and compares the features of x86-64,ARM,and RISC-V in the context of security defense design.RISC-V has some advantages over other architectures due to its opening ecosystem,making the implementation of some low-cost and promising defense techniques possible.

关 键 词：RISC-V 内存安全 硬件安全扩展 处理器 

分 类 号：TP309[自动化与计算机技术—计算机系统结构] TP332[自动化与计算机技术—计算机科学与技术]