Efficient data protection for distributed shared memory multiprocessors

Abstract

Data security in computer systems has recently become an increasing concern, and hardware-based attacks have emerged. As a result, researchers have investigated hardware encryption and authentication mechanisms as a means of addressing this security concern. Unfortunately, no such techniques have been investigated for Distributed Shared Memory (DSM) multiprocessors, and previously proposed techniques for uni-processor and Symmetric Multiprocessor (SMP) systems cannot be directly used for DSMs. This work is the first to examine the issues involved in protecting secrecy and integrity of data in DSM systems. We first derive security requirements for processor-processor communication in DSMs, and find that different types of coherence messages need different protection. Then we propose and evaluate techniques to provide efficient encryption and authentication of the data in DSM systems. Our simulation results using SPLASH-2 benchmarks show that the execution time overhead for our three proposed approaches is small and ranges from 6% to 8% on a 16-processor DSM system, relative to a similar DSM without support for data secrecy and integrity.

Defending Against Attacks on Main Memory Persistence

“…These operating systems require that the memory architecture defend against offline physical attacks and avoid run-time processor stalls-a unique combination of feature and performance that no memory system has previously achieved. Furthermore, the architecture must support all legacy software and hardware interfaces, including DMA and multiprocessors [24,29], and do so within a modest component footprint. We explore how these features are simultaneously achieved within our MECU-enhanced architecture in the following sections.…”

“…Proposals include hashing over cache lines and storing values in separate or statically-allocted memory [18], creating a Merkle hash tree of memory segments and caching the results [13,31], and using GCM encryption to simultaneously encrypt and hash memory blocks [24]. Adapting these solutions to our architecture requires a careful analysis of the performance 5 Embedded systems with a 10 MHz clock traditionally have a 16-bit address space.…”

I2SEMS: Interconnects-Independent Security Enhanced Shared Memory Multiprocessor Systems

“…Rogers, et al pointed out the limitation of above schemes on DSM systems and proposed an efficient data protection design [21]. By focusing on point-to-point communications of the directory-based cache coherence protocol, they were able to utilize DSM systems' temporal locality of communications, which means a processor communicates with a relatively small Please note that in multiprocessor shared-memory protection, all processors and related components like the memory controller are assumed to share the same secret key.…”

“…A recent study by Rogers, et al proposed a novel mechanism for protecting cache-to-cache communication in distributed shared memory (DSM) multiprocessors as a remedy for this problem [21]. However, since their design focused on the directory-based cache coherence protocol used for the point-to-point communication, their idea cannot be directly applied to the systems with other cache coherence protocols used for multicasting/broadcasting communication such as the token coherence protocol [2,16].…”

PoisonIvy: Safe speculation for secure memory

“…It ensures confidentiality with encryption and ensures integrity with Merkle trees [4], [6], [10], [38]. Security adds overheads, motivating performance optimizations that cache metadata and speculate around safeguards [11], [26], [27], [33], [34], [37], [49]. We survey recent progress to motivate our solution, PoisonIvy, which builds atop best practices to address remaining performance challenges.…”