ERIM: Secure, Efficient In-process Isolation with Memory Protection Keys (MPK)

TL;DR

ERIM introduces a hardware-enforced isolation technique on x86 CPUs using memory protection keys, enabling low-overhead, high-frequency domain switching for secure applications without requiring kernel modifications.

Contribution

The paper presents ERIM, a novel approach combining x86 protection keys with binary inspection to achieve efficient, secure in-process isolation at high switching rates.

Findings

Overhead is less than 1% at 100,000 switches per second

Applicable to existing applications without compiler changes

Operates on stock Linux kernels with minimal effort

Abstract

Isolating sensitive state and data can increase the security and robustness of many applications. Examples include protecting cryptographic keys against exploits like OpenSSL's Heartbleed bug or protecting a language runtime from native libraries written in unsafe languages. When runtime references across isolation boundaries occur relatively infrequently, then conventional page-based hardware isolation can be used, because the cost of kernel- or hypervisor-mediated domain switching is tolerable. However, some applications, such as the isolation of cryptographic session keys in network-facing services, require very frequent domain switching. In such applications, the overhead of kernel- or hypervisor-mediated domain switching is prohibitive. In this paper, we present ERIM, a novel technique that provides hardware-enforced isolation with low overhead on x86 CPUs, even at high switching rates (ERIM's measured overhead is less than 1% for 100,000 switches per second). The key idea is to combine protection keys (MPKs), a feature recently added to x86 that allows protection domain switches in userspace, with binary inspection to prevent circumvention. We show that ERIM can be applied with little effort to new and existing applications, doesn't require compiler changes, can run on a stock Linux kernel, and has low runtime overhead even at high domain switching rates.