CHERI: A Hybrid Capability-System Architecture for Scalable Software Compartmentalization

作者：Robert N. M. Watson, Jonathan D. Woodruff, Peter G. Neumann, Simon W. Moore, Jonathan Stephen Anderson, David Chisnall, Nirav Dave, Brooks Davis, Khilan Gudka, Ben Laurie, Steven J. Murdoch, Robert M. Norton, Michael Roe, Stacey Son, Munraj Vadera · 年份：2015 · DOI：10.1109/sp.2015.9 · 被引用次数：269 · 研究领域：Security and Verification in Computing、Advanced Malware Detection Techniques、Distributed systems and fault tolerance

CHERI extends a conventional RISC Instruction-Set Architecture, compiler, and operating system to support fine-grained, capability-based memory protection to mitigate memory-related vulnerabilities in C-language TCBs. We describe how CHERI capabilities can also underpin a hardware-software object-capability model for application compartmentalization that can mitigate broader classes of attack. Prototyped as an extension to the open-source 64-bit BERI RISC FPGA soft-core processor, Free BSD operating system, and LLVM compiler, we demonstrate multiple orders-of-magnitude improvement in scalability, simplified programmability, and resulting tangible security benefits as compared to compartmentalization based on pure Memory-Management Unit (MMU) designs. We evaluate incrementally deployable CHERI-based compartmentalization using several real-world UNIX libraries and applications.