Trust Guard Extension for Enhanced Security Features in Light-weight Embedded Environment = 경량 임베디드 환경의 보안 강화를 위한 TGX 프레임워크|RISS 상세보기

다국어 초록 (Multilingual Abstract)

This dissertation presents a comprehensive study on the enhancement of unprivileged domain isolation in reduced instruction set computer (RISC)-V architectures, focusing on the design and implementation of the trust guard extension (TGX) framework. Embedded systems, essential parts of the evolving Internet of Things environment, are increasingly required to perform real-time complex tasks with limited computational resources. Robust security mechanisms are increasingly imperative as the role of these devices expands from controlling simple devices to managing complex, networked systems. However, traditional RISC-V techniques for memory isolation are unable to support the switching between a trusted execution environment without incurring a performance overhead.
This dissertation addresses the critical challenge of supporting domain isolation within RISC-V architectures. The primary challenge is to implement effective hardware-based memory protection mechanisms that operate efficiently within the constraints of embedded systems. Traditional software-based protections are reasonable, but they do not provide the necessary support for rapid memory permission changes. Furthermore, existing hardware-based solutions, such as Arm TrustZone, while effective, are not natively supported on RISC-V and have their own limitations.
A meticulous and structured approach was employed in implementing the TGX framework, beginning with a thorough analysis of the existing RISC-V architecture to identify key areas where domain isolation could be enhanced without significantly impacting performance. This analysis led to the development of two primary protection methods: Segment Level Memory Protection (SLMP) and Instruction Level Memory Protection (ILMP). SLMP extends the capabilities of Physical Memory Protection (PMP) by providing fine-grained, execution-oriented isolation. This allows for precise control over memory access based on execution segments, significantly reducing the risk of unauthorized access. ILMP complements this by offering dynamic, real-time access controls at the instruction level, adjusting memory access permissions based on the executing instructions to ensure compliance with security policies.
The TGX framework adopts a hybrid approach that combines inter-domain, execution-oriented isolation with intra-domain, instruction-level access controls. This approach leverages the strengths of existing technologies, such as MPK, while enhancing them with the unique capabilities of RISC-V. The framework ensures seamless and secure transitions between trust execution environment in user space without requiring software intervention at the privilege level.
This dissertation advances the state-of-the-art in domain isolation for RISC-V and provides a scalable and efficient solution for enhancing security in embedded systems. By employing a comprehensive methodology with a detailed evaluation of memory-protection features, their effectiveness, and hardware overhead implications, the dissertation offers significant contributions to the field of embedded system security. The research includes a practical hardware implementation evaluation and software overhead analysis, utilizing benchmarks such as Embench-iot to demonstrate the effectiveness of the proposed approach in real-world IoT environments. These findings and methodologies provide a foundation for future research directions aimed at further optimizing and expanding domain isolation technologies.

번역하기

목차 (Table of Contents)

I. Introduction 1
A. Research Background 1
B. Contributions 6
C. Dissertation Outline 7
II. Preliminary 9

I. Introduction 1
A. Research Background 1
B. Contributions 6
C. Dissertation Outline 7
II. Preliminary 9
A. RISC-V 9
1. RISC-V Instruction Set Architecture 10
2. Physical Memory Protection 16
B. Secure Embedded RISC-V System 21
1. Architecture Overview of Secure Embedded RISC-V System 21
2. Limitations of Secure Embedded RISC-V System 22
C. RISC-V Ibex core 26
1. Hardware architecture overview of Ibex core 26
2. Performance and hardware cost of Ibex core 28
III. Domain Isolation 30
A. Review of Existing Domain Isolation Techniques 31
1. Execution-Aware Memory Protection (EA-MPU) 31
2. Arm TrustZone-M 32
3. Memory Protection Key 34
4. Memory Tagging Extension 36
B. Domain Isolation Methods 38
1. Inter-Domain Isolation 38
2. Intra-Domain Isolation 40
C. SLMP: Inter-Domain Isolation in RISC-V Architecture 42
1. Design of Inter-Domain Isolation in SLMP 42
2. Implementation of SLMP in RISC-V 45
3. Evaluation of SLMP Implementation 53
4. Key Security Enhancement from SLMP: Multi-Domain Support 58
5. Limitation of SLMP: Inefficient Domain Configuration 58
D. ILMP: Intra-Domain Isolation in RISC-V Architecture 60
1. Intra-domain isolation design in ILMP 60
2. Implementation of ILMP in RISC-V 63
3. Evaluation of ILMP 71
4. Key Security Enhancement from ILMP: Robust Against Exploitation of Shared Memory 77
5. Limitation of ILMP: Limited Number of Domains 78
E. Comparative Analysis of SLMP and ILMP 78
IV. Trust Guard eXtension Framework 80
A. Design of TGX Framework 82
1. Domain Boundaries in the TGX Framework 84
2. Enhanced Intra-Domain Isolation for the TGX Framework 86
3. Efficient Inter-Domain Isolation for the TGX Framework 87
4. Novel ISA for the TGX Framework 88
B. Implementation of TGX Framework in RISC-V 92
1. Domain Configuration Register 92
2. Instruction Set Architecture 97
3. Processor Status Register 99
4. Memory Protection Logic 102
C. Evaluation of TGX Framework 108
1. Hardware overhead evaluation 109
2. Domain Isolation Effectiveness 111
D. Experimental 113
1. Experimental Method 113
2. Evaluate Standard RISC-V Memory Isolation Overhead 114
3. Evaluate TGX Framework Overhead 118
V. Discussion 126
A. Comprehensive Security Enhancements in TGX 126
1. Advanced Domain Isolation Techniques 126
2. Comprehensive Security Measures 129
3. Optimized Security Solutions for Embedded Systems 130
B. Comparison with SLMP , ILMP and TGX framework. 133
C. Comparison with Related Techniques 135
VI. Conclusions 138
A. Conclusions 138
B. Future Works 139

참고문헌 (Reference)

1. Intel SGX explained, COSTAN, Victor, DEVADAS, Srinivas, Cryptology ePrint Archive, , 2016

2. Home automation networksA survey, Toschi, G. M., Campos, L. B., Cugnasca, C. E., 50, 42–54, , 2017

3. Principles of remote attestation, COKER, George, et al, 10: 63-81, , 2011

4. ARM Architecture Reference Manual, Seal, D., Pearson Education: San Fransisco, CA, USA, , 2001

5. ARMv8-M Architecture Technical Overview, Yiu, J., In ARM White Paper; ARM: Waltham, MA, USA, , 2015

6. TyTANTiny Trust Anchor for Tiny Devices, El Mahjoub, B., Koeberl, P., Sadeghi, A. R., Brasser, F., Wachsmann, C., In Proceedings of the 52nd Annual Design Automation Conference, New York, NY, USA, 8–12, , 2015

7. CoMeTConfigurable Tagged Memory Extension, Pratama, D., Lee, J., Kim, H., Kwon, D., Kim, M., 21, 7771, , 2021

8. A scalable web cache consistency architecture, BRESLAU, Lee, SHENKER, Scott, YU, Haobo, 29.4: 163-174, , 1999

9. EPKScalable and Efficient Memory Protection Keys, Xia, Y., Chen, H., Li, W., Gu, J., Li, H., In Proceedings of the 2022 USENIX Annual Technical Conference (USENIX ATC 22); USENIX Association: Carlsbad, CA, USA pp. 609–624, , 2022

10. Design of the RISC-V Instruction Set Architecture, Waterman, A. S., Ph. D. `Thesis, University of California: Berkeley, CA, USA, , 2016