Policy-Driven Memory Protection for Reconfigurable Hardware

Abstract

Abstract. While processor based systems often enforce memory protection to prevent the unintended sharing of data between processes, current systems built around reconfigurable hardware typically offer no such protection. Several reconfigurable cores are often integrated onto a single chip where they share external resources such as memory. While this enables small form factor and low cost designs, it opens up the opportunity for modules to intercept or even interfere with the operation of one another. We investigate the design and synthesis of a memory protection mechanism capable of enforcing policies expressed as a formal language. Our approach includes a specialized compiler that translates a policy of legal sharing to reconfigurable logic blocks which can be directly transferred to an FPGA. The efficiency of our access language design flow is evaluated in terms of area and cycle time across a variety of security scenarios.

Automation for creating and configuring security manifests for hardware containers

“…Huffmire et al [9] demonstrate compiler translation of an access policy into a hardware execution monitor for enforcing policies such as compartmentalization, access control, secure hand-off, Chinese wall, and redaction. This execution monitor is meant for hardware designs with isolated circuitry that communicate through the monitor and is not applicable directly to software applications that share hardware resources, but compilation tools for security policies may benefit our approach.…”

Security Primitives for Reconfigurable Hardware-Based Systems

“…The modules can only use the bus through this arbiter, which only allows each module to read during its designated time slice. If we want to connect the bus to a memory, then a memory monitor is also required; for this work we assume that such a configuration can be implemented on the FPGA using the results of our previous work [Huffmire et al 2006].…”

“…Since the space of intrusion detection rule sets is infinite, the space of detection cores is also infinite. In our earlier work [Huffmire et al 2006], we developed a memory protection scheme for reconfigurable hardware in which a reconfigurable reference monitor enforces a policy that specifies the legal sharing of memory. Partial reconfiguration could allow the system to change the policy being enforced by swapping in a different reference monitor, assuming that you could overcome the very difficult challenge of ensuring the security and correctness of the handover.…”

“…One way of protecting memory in an FPGA system is to use a reference monitor that is loaded onto the FPGA along with the other cores [Huffmire et al 2006]. Here, the reference monitor is analogous to the guard because it decides the legality of every memory access according to a policy.…”

“…To provide memory protection on an FPGA, we proposed the use of a reconfigurable reference monitor that enforces the legal sharing of memory among cores [Huffmire et al 2006]. A memory access policy is expressed in a specialized language, and a compiler translates this policy directly to a circuit that enforces the policy.…”