Processor Sandbox Support for Untrusted Code Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computing devices face challenges in securely executing untrusted code without extensive software-based isolation techniques, which can lead to performance overhead and vulnerability to malicious attacks, as existing methods like Intel® page protection keys and Google® Native Client (NaCl) are inadequate in protecting against manipulation by attackers.
Innovation Solution
A computing device with processor sandbox support enables untrusted code execution by using sandbox domains within the same virtual address space, allowing memory protection without context switches or permission level changes, and enforcing sandbox isolation through hardware-assisted mechanisms, such as sandbox support in the processor, to manage and enforce memory access and instruction execution within these domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software-based isolation techniques are used to execute untrusted code, then security is improved, but performance deteriorates due to context switches and permission level changes
Solution Approach 1:
The patent divides the address space into multiple domains (trusted domain and untrusted domains) with distinct memory protection keys. Each domain is segmented with its own key set, allowing the processor to enforce isolation boundaries without requiring context switches or permission level changes, thus maintaining both security and performance
Solution Approach 2:
The patent introduces memory protection keys as an intermediary mechanism between trusted and untrusted code domains. These keys act as mediators that enforce domain boundaries at the memory access level, eliminating the need for software-based context switches while maintaining security isolation
2Reliability
If Intel page protection keys are used to protect domains, then accidental memory access is prevented, but protection against malicious attackers is insufficient
Solution Approach 1:
The patent applies preliminary anti-action by implementing hardware-enforced domain boundaries that prevent malicious code from manipulating protection keys. The processor architecture itself enforces domain isolation at the memory access level, preemptively blocking attacks before they can exploit software vulnerabilities in key management
3Reliability
If software-based sandbox isolation is implemented, then untrusted code execution is secured, but extensive toolchain modifications are required
Solution Approach 1:
The patent enables self-service sandboxing where the processor architecture automatically enforces domain isolation through hardware-supported memory protection keys. The system serves itself by providing built-in domain management capabilities that eliminate the need for extensive compiler and linker modifications, reducing toolchain complexity while maintaining security
Data Source
AI summary
Technologies for untrusted code execution include a computing device having a processor with sandbox support. The computing device executes code included in a native domain in a non-privileged, native processor mode. The computing device may invoke a sandbox jump processor instruction during execution of the code in the native domain to enter a sandbox domain. The computing device executes code in the sandbox domain in a non-privileged, sandbox processor mode in response to invoking the sandbox jump instruction. While executing in the sandbox processor mode, the processor denies access to memory outside of the sandbox domain and may deny execution of one or more prohibited instructions. From the sandbox domain, the computing device may execute a sandbox exit instruction to exit the sandbox domain and resume execution in the native domain. The computing device may execute processor instructions to configure the sandbox domain. Other embodiments are described and claimed.