Iso-strongXstrong A Flexible Architecture for Hardware-Managed Isolated.pdfVIP

Iso-X: A Flexible Architecture for Hardware-Managed Isolated Execution Dmitry Evtyushkin , Jesse Elwell , Meltem Ozsoy , Dmitry Ponomarev , Nael Abu Ghazaleh and Ryan Riley State University of New York at Binghamton, University of California at Riverside, Qatar University devtyushkin,jelwell,mozsoy,dima@, nael@, ryan.riley@.qa Abstract—We consider the problem of how to provide an [13], [14], [15], [24], [38], [50], [54]. execution environment where the application’s secrets are safe One approach to providing a secure execution environ- even in the presence of malicious system software layers. ment in the presence of malicious software layers uses the We propose Iso-X: a flexible, fine-grained hardware-supported framework that provides isolation for security-critical pieces of concept of isolated execution, where the security-critical an application such that they can execute securely even in the pieces of application code execute in isolated compart- presence of untrusted system software. Isolation is achieved by ments [4], [7], [8], [10], [11], [20], [21], [26], [27], [30], creating and dynamically managing execution compartments [44]. These compartments are inaccessible to the system to host critical fragments of code and associated data. Iso- software layers and are managed either entirely by the X provides fine-grained isolation at the memorylevel, flexible allocation of memory, and a low-complexity, h