A Processor-Level Framework for High Dependability and Security
A common processor-level framework that can provide application-aware reliability and security is attractive and timely. The Reliability and Security Engine, or RSE, project at the University of Illinois, Urbana-Champaign is developing a common framework to provide a variety of application-aware techniques for error-detection, masking of security vulnerabilities and recovery under one umbrella in a uniform, low-overhead manner. Hardware-implemented error-detection and security mechanisms are embedded as modules in the hardware-level framework, called the reliability and security Engine, which has been designed as an integral part of a superscalar microprocessor. The embedded hardware modules execute in parallel with the core pipeline. The goal of the project is to provide application aware runtime checking techniques to guard against both accidental failures and malicious attacks.
The framework serves two purposes:
- it hosts hardware modules that provide reliability and security services, and
- it implements an interface between the modules and the main pipeline and between the modules and the executing software
In our approach, the RSE framework monitors the processor pipeline by inserting probes at critical points. The RSE acts as a switching fabric, routing signals to the appropriate modules. The RSE is a generic framework, capable of supporting a variety of reliability- and security-checking techniques, such as a checking a module that selectively recomputes sections of a program; a hang detection module, which receives heartbeats from processes and monitors their execution; and an information security flow module that tracks dependencies to prevent nonsecure instructions from modifying critical instructions.
Currently, the RSE has been implemented on both the pipelines of the DLX and the Leon3. We are also investigating implementing the RSE on the OpenSPARC platform.
For more information, please read this technical report.
For more information on the various modules implemented on the RSE, see the Detectors project page.