Abstract:In-process compartmentalization and access control have been actively explored to provide in-place and efficient isolation of in-process security domains. Many works have proposed compartmentalization schemes that leverage hardware features, most notably using the new page-based memory isolation feature called Protection Keys for Userspace (PKU) on x86. Unfortunately, the modern ARM architecture does not have an equivalent feature. Instead, newer ARM architectures introduced Pointer Authentication (PA) and Memory Tagging Extension (MTE), adapting the reference validation model for memory safety and runtime exploit mitigation. We argue that those features have been underexplored in the context of compartmentalization and that they can be retrofitted to implement a capability-based in-process access control scheme. This paper presents Capacity, a novel hardware-assisted intra-process access control design that embraces capability-based security principles. Capacity coherently incorporates the new hardware security features on ARM that already exhibit inherent characteristics of capability. It supports the life-cycle protection of the domain's sensitive objects -- starting from their import from the file system to their place in memory. With intra-process domains authenticated with unique PA keys, Capacity transforms file descriptors and memory pointers into cryptographically-authenticated references and completely mediates reference usage with its program instrumentation framework and an efficient system call monitor. We evaluate our Capacity-enabled NGINX web server prototype and other common applications in which sensitive resources are isolated into different domains. Our evaluation shows that Capacity incurs a low-performance overhead of approximately 17% for the single-threaded and 13.54% for the multi-threaded webserver.

Fine-grained Protection Domain Model in a Process and Its Implementation

A Multi-Protection Domains Process Model and Its Implementation

Process Stability Modeling and Attack Protection of Industrial Control System Based on Reverse Cloud Algorithm Model

Intrinsic Security and Self-Adaptive Cooperative Protection Enabling Cloud Native Network Slicing

Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

The Design of an Useful Security Management Model of PDMS and Its Realization

Process-based Access Control Model

Research on Information Protection Model Based on Process Isolation

Generalized Taint Propagation Model for Access Control in Operation Systems

A Reference Model for Database Security Proxy

A Dynamic Cross Domain Access Control Model for Multi-level System

A Framework for Implementing Dynamically Modified Least Privilege Security Policy

Croth: Effective Process Protection and Monitoring with Hardware Virtualization

Model Barrier: A Compact Un-Transferable Isolation Domain for Model Intellectual Property Protection

FineDroid: Enforcing Permissions with System-Wide Application Execution Context.

Transparent Security-Sensitive Process Protection Via VMM-Based Process Shadowing.

Dancing with Wolves: an Intra-Process Isolation Technique with Privileged Hardware.

A Mobile Access Control Architecture For Multiple Security Domains Environment

A Fine-Grained Mandatory Access Control Model for XML Documents

Capacity: Cryptographically-Enforced In-Process Capabilities for Modern ARM Architectures (Extended Version)

Formal Modeling and Security Analysis for Intra-level Privilege Separation.