一句话：提出 TrustGuard 隔离架构，用可插拔 Sentry 硬件限制仅可信软件正确执行产生的通信，性能开销低于 15%。
硬件组件因设计、制造、部署和运行中的复杂性而具有巨大攻击面，外部通信尤其威胁系统安全。本文提出 TrustGuard 遏制架构：用简单、可插拔的门卫硬件 Sentry 在不可信系统与外部接口之间建立物理隔离，仅允许由可信软件正确执行产生的通信离开系统，从而阻止恶意或错误硬件/软件行为对外造成影响。Sentry 代码量不足简单顺序处理器的一半，其简单性和可插拔性还使形式验证、受控制造与供应链多样化等保护根信任的措施成为可能。评估显示性能影响低于 15%。
Software security techniques rely on correct execution by the hardware. Securing hardware components has been challenging due to their complexity and the proportionate attack surface they present during their design, manufacture, deployment, and operation. Recognizing that external communication represents one of the greatest threats to a system's security, this paper introduces the TrustGuard containment architecture. TrustGuard contains malicious and erroneous behavior using a relatively simple and pluggable gatekeeping hardware component called the Sentry. The Sentry bridges a physical gap between the untrusted system and its external interfaces. TrustGuard allows only communication that results from the correct execution of trusted software, thereby preventing the ill effects of actions by malicious hardware or software from leaving the system. The simplicity and pluggability of the Sentry, which is implemented in less than half the lines of code of a simple in-order processor, enables additional measures to secure this root of trust, including formal verification, supervised manufacture, and supply chain diversification with less than a 15% impact on performance.
@inproceedings{paperbot4919,
title = {Architectural Support for Containment-based Security},
author = {Hansen Zhang and Soumyadeep Ghosh and Jordan Fix and Sotiris Apostolakis and Stephen R. Beard and Nayana P. Nagendra and Taewook Oh and David I. August},
booktitle = {ASPLOS},
year = {2019},
doi = {10.1145/3297858.3304020}
}