A Pliable Hybrid Architecture for Code Isolation
Total Page：16
File Type：pdf, Size：1020Kb
A PLIABLE HYBRID ARCHITECTURE FOR CODE ISOLATION A Dissertation Presented to The Academic Faculty by Ivan B. Ganev In Partial Fulfillment of the Requirements for the Degree Doctor of Philosophy in the College of Computing Georgia Institute of Technology August 2007 Copyright c 2007 by Ivan B. Ganev A PLIABLE HYBRID ARCHITECTURE FOR CODE ISOLATION Approved by: Karsten Schwan, Adviser Santosh Pande College of Computing College of Computing Georgia Institute of Technology Georgia Institute of Technology Mustaque Ahamad Kiran Panesar College of Computing Google Inc. Georgia Institute of Technology Greg Eisenhauer Date Approved: 9 April 2007 College of Computing Georgia Institute of Technology For Dana and Ginka. iii ACKNOWLEDGEMENTS For the successful completion of this work, I owe an enormous debt of gratitude to many people who have so generously given me their friendship, encouragement, and time. Perhaps too many to list individually, yet, I would be remiss not to try. Thus, in no particular order, I would like to thank: • Karsten Schwan, for giving me complete freedom to pursue my research interests and for always being so supportive, understanding, resourceful, and wise. I could not have wished for a better adviser. • Greg Eisenhauer, for sharing his technical expertise and solid foundation of code. • Kiran Panesar, Mustaque Ahamad, and Santosh Pande, for their guidance and helpful suggestions. • Ken Mackenzie, for being a source of true inspiration. • Josh Fryman, for so many enlightening discussions, ruthless paper revisions, and his contagiously positive attitude. • Craig Ulmer, for all the jokes and encouragement. • Richard West, Christian Poellabauer, Himanshu Raj, Sanjay Kumar, Balasubrama- nian Seshasayee, and countless other fellow Georgia Tech students for their time and friendship. • My parents, Denka and Boris Ganev, for their constant love and support. • Last but not least, my lovely wife Ginka, for always being there for me and for putting up with the endless days and nights I spent hacking in the lab, and our beautiful baby Dana, for lighting up our days. This dissertation truly would not have been possible without you. Thank you! iv TABLE OF CONTENTS DEDICATION ....................................... iii ACKNOWLEDGEMENTS ................................ iv LIST OF TABLES .................................... viii LIST OF FIGURES .................................... ix LIST OF LISTINGS .................................... xi SUMMARY ......................................... xiii I INTRODUCTION .................................. 1 1.1 Background . 1 1.2 Motivation . 3 1.3 Terminology . 5 1.4 Thesis . 7 1.5 Organization . 7 II ISOLATION REQUIREMENTS .......................... 9 2.1 Formal Basis . 10 2.2 Attack Types . 13 2.3 Attack Targets . 14 2.3.1 State Automaton . 15 2.3.2 Read/Write Head . 16 2.3.3 Tape . 17 2.4 Summary . 17 III HYBRID CODE ISOLATION ........................... 19 3.1 Homogeneous Techniques . 20 3.1.1 Software Fault Isolation . 20 3.1.2 Hardware Fault Isolation . 35 3.2 Heterogeneous Hybrid . 48 3.2.1 Metrics . 48 3.2.2 Cost/Benefit Differentials . 54 v 3.2.3 Impact of CPU Micro-architecture . 56 3.2.4 Hybrid Prototype Technical Description . 58 3.3 Other Hybrids . 66 IV EXPERIMENTAL EVALUATION ......................... 67 4.1 Methodology . 67 4.1.1 Timing . 68 4.1.2 Statistics . 74 4.2 Experimental Platform . 75 4.3 Micro-benchmarks . 78 4.3.1 Latency . 78 4.3.2 Throughput . 87 4.3.3 Qualitative Measures . 89 4.4 Macro-Benchmarks . 90 4.4.1 Motivation . 90 4.4.2 Methodology . 92 4.4.3 Aggregate Runtime . 92 4.4.4 Application-Relative Cost & Performance . 94 V RELATED WORK ................................. 96 5.1 Formal Methods . 96 5.1.1 Proof-Carrying Code . 97 5.1.2 SLAM and Microsoft Driver Verifier . 98 5.2 Type-Safe Languages . 99 5.2.1 Modula-3 . 100 5.2.2 Typed Assembly Language . 100 5.2.3 Type-Safe C . 101 5.2.4 Singularity . 102 5.3 Software Fault Isolation . 103 5.3.1 MiSFIT . 105 5.3.2 PittSFIeld . 105 5.4 Hardware Fault Isolation . 106 vi 5.4.1 Paging-Based . 107 5.4.2 Segmentation-Based . 108 5.5 Resource Control . 110 5.5.1 RBClick . 110 5.6 Summary . 111 VI CONCLUSION AND FUTURE WORK . 112 6.1 Conclusions . 112 6.2 Future Work . 114 APPENDIX A MICRO-BENCHMARK MEASUREMENT CODES . 115 APPENDIX B MACRO-BENCHMARK MEASUREMENT CODES . 145 REFERENCES ....................................... 172 VITA ............................................ 180 vii LIST OF TABLES 1 Comparison of isolation techniques’ features. 50 2 Experimental platform’s hardware specifications. 76 3 Experimental platform’s software specifications. 78 4 Comparison of the throughput impact of isolation techniques. 89 5 Experimentally measured performance loss relative to non-isolated perfor- mance. 95 6 Edgebreaker cache profile. 153 7 GrayEdge cache profile. 167 viii LIST OF FIGURES 1 An Ordinary Turing Machine. 10 2 A Universal Turing Machine. 11 3 A Universal Turing Machine interpreting an extended Ordinary Turing Ma- chine. ....................................... 12 4 Types of attacks. 14 5 Memory segment restrictions for the sandboxing code from Listing 2. 22 6 Memory segment restrictions for the isolation code from Listing 3. 23 7 Memory segment layout with top and bottom guard buffers. 24 8 Execution control restrictions. 27 9 Segmentation and paging mechanisms. 37 10 Logical to linear address translation. 37 11 Unprotected flat memory model. 38 12 Protected flat memory model. 39 13 Multi-segment memory model. 39 14 Host/extension segmentation configuration. 40 15 Linear to physical address translation. 42 16 Privilege rings. 43 17 Segment descriptor. 44 18 PDE and PTE formats for 4 KB pages. 45 19 Basic costs of safe control transfers. 51 20 Aggregate costs of a safe control transfer. 52 21 Typical extension instruction mix. 53 22 Code inflation of software fault isolation. 53 23 Inverse cost differentials motivating SFI/HFI hybrids. 54 24 Hybrid vs. homogeneous technique overheads. 55 25 CPU pipeline depth evolution. 56 26 Architectural effects on code isolation overheads. 57 27 Null function call as a function of the number of its parameters. 82 28 Invocation latency for a null software-isolated extension. 83 ix 29 Invocation latency for a null hardware-isolated extension. 85 30 Invocation latency for a null hybrid-isolated extension. 86 31 Demonstration of the gray-scaling and edge detection image processing load. 91 32 Breakdown of experimentally measured performance for the sample isolated real-life extensions. 93 33 Experimentally measured isolation cost, presented in application-specific terms. 94 34 Experimentally measured performance loss relative to non-isolated perfor- mance. The left figure reports results for the EdgeBreaker example and the right one for GrayEdge. 95 35 Example 3D triangular mesh model. 152 x LIST OF LISTINGS 1 Example of code vetting through binary rewriting. 21 2 Memory isolation for general addressing modes and arbitrary segment bound- aries and size. 22 3 Faster memory isolation for general addressing modes and 2N byte sized and aligned segments. 23 4 Buffered memory isolation for general addressing modes and arbitrary seg- ment boundaries and size. 25 5 Generic memory isolation optimization where the effective address is pre- computed in a single register. 26 6 An.