Paper Info
Title
CHERI: A Hybrid Capability-System Architecture for Scalable Software Compartmentalization
Abstract
CHERI extends a conventional RISC Instruction-Set Architecture, compiler, and operating system to support fine-grained, capability-based memory protection to mitigate memory-related vulnerabilities in C-language TCBs. We describe how CHERI capabilities can also underpin a hardware-software object-capability model for application compartmentalization that can mitigate broader classes of attack. Prototyped as an extension to the open-source 64-bit BERI RISC FPGA soft-core processor, Free BSD operating system, and LLVM compiler, we demonstrate multiple orders-of-magnitude improvement in scalability, simplified programmability, and resulting tangible security benefits as compared to compartmentalization based on pure Memory-Management Unit (MMU) designs. We evaluate incrementally deployable CHERI-based compartmentalization using several real-world UNIX libraries and applications.
Year
DOI
Venue
2015
10.1109/SP.2015.9
IEEE Symposiumon Security and Privacy
Field
DocType
ISSN
Memory protection,Computer science,Unix,Compiler,Reduced instruction set computing,Software,Software architecture,Systems architecture,Scalability,Embedded system
Conference
1081-6011
Citations 
PageRank 
References 
43
1.47
26
Authors
15
Name
Order
Citations
PageRank
Robert N. M. Watson148836.14
Jonathan Woodruff21546.16
Peter G. Neumann3633175.98
simon w moore421718.83
Jonathan Anderson518214.39
D. Chisnall623814.94
Nirav Dave719514.61
Brooks Davis81769.02
Khilan Gudka91036.99
Ben Laurie1029714.00
Steven J. Murdoch1180657.90
Robert Norton121356.15
Michael Roe13472.89
Stacey Son14663.57
Munraj Vadera15752.71