Dynamically reconfigurable hardware offers significant adap- tability and performance advantages for modern System-on-Chip (SoC) architectures, but also enlarges the system’s attack surface. Previous work has shown that reconfigurable accelerators can exploit weaknesses in Input Output Memory Management Unit (IOMMU) to perform unauthorized Direct Memory Accesss (DMAs), revealing limitations in current I/O protection mechanisms. This paper presents ARMOR, a hardware mechanism designed to ensure the trustworthy integration of reconfigurable accelerators within IOMMU-enabled SoCs. ARMOR enforces secure device identity verification and provides runtime supervision of accelerator activity to detect and prevent abnormal or malicious behavior. Implemented in a RISC-V environment and validated through simulation, it effectively prevents I/O-based attacks while maintaining system compatibility and low performance overhead.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

ARMOR: Accelerator Runtime Monitoring and cOntrolled Identity enfoRcement

  • Aya Jendoubi,
  • Jean-Christophe Prevotet,
  • Philippe Tanguy,
  • Pascal Cotret

摘要

Dynamically reconfigurable hardware offers significant adap- tability and performance advantages for modern System-on-Chip (SoC) architectures, but also enlarges the system’s attack surface. Previous work has shown that reconfigurable accelerators can exploit weaknesses in Input Output Memory Management Unit (IOMMU) to perform unauthorized Direct Memory Accesss (DMAs), revealing limitations in current I/O protection mechanisms. This paper presents ARMOR, a hardware mechanism designed to ensure the trustworthy integration of reconfigurable accelerators within IOMMU-enabled SoCs. ARMOR enforces secure device identity verification and provides runtime supervision of accelerator activity to detect and prevent abnormal or malicious behavior. Implemented in a RISC-V environment and validated through simulation, it effectively prevents I/O-based attacks while maintaining system compatibility and low performance overhead.