Hardware virtualization allows multiple security-critical and ordinary (insecure) processes to co-execute on a processor. These processes temporally share hardware resources and endure numerous security threats on the microarchitecture state. State-of-the-art secure processor architectures, such as MI6 and IRONHIDE enable capabilities to execute security-critical processes in hardware isolated enclaves utilizing the strong isolation security primitive. The MI6 processor purges small state resources on each enclave entry/exit and statically partitions the last-level cache and DRAM regions to ensure strong isolation. IRONHIDE takes a spatial approach and creates two isolated clusters of cores in a multicore processor to ensure strong isolation for processes executing in the enclave cluster. Both architectures observe performance degradation due to static partitioning of shared hardware resources. OPTIMUS proposes a security-centric dynamic hardware resource partitioning scheme that operates entirely at runtime and ensures strong isolation. It enables deterministic resource allocations at the application level granularity, and limits the number of hardware reconfigurations to ensure bounded information leakage via the timing and termination channels. The dynamic hardware resource partitioning capability of OPTIMUS is shown to co-optimize performance and security for the MI6 and IRONHIDE architectures.

中文翻译：

---

OPTIMUS：一种以安全为中心的动态硬件分区方案，用于防止微架构状态攻击的处理器

硬件虚拟化允许多个安全关键和普通（不安全）进程在一个处理器上共同执行。这些进程暂时共享硬件资源，并在微架构状态下承受众多安全威胁。MI6 和 IRONHIDE 等最先进的安全处理器架构能够利用强大的隔离安全原语在硬件隔离的飞地中执行安全关键流程。MI6 处理器清除每个 enclave 入口/出口上的小状态资源，并对最后一级缓存和 DRAM 区域进行静态分区以确保强隔离。IRONHIDE 采用空间方法并在多核处理器中创建两个隔离的内核集群，以确保对在 enclave 集群中执行的进程进行强隔离。由于共享硬件资源的静态分区，两种架构都观察到性能下降。OPTIMUS 提出了一种以安全为中心的动态硬件资源分区方案，完全在运行时运行并确保强隔离。它实现了应用级粒度的确定性资源分配，并限制了硬件重新配置的次数，以确保通过定时和终止通道进行有限的信息泄漏。显示 OPTIMUS 的动态硬件资源分区能力可以协同优化 MI6 和 IRONHIDE 架构的性能和安全性。它实现了应用级粒度的确定性资源分配，并限制了硬件重新配置的次数，以确保通过定时和终止通道进行有限的信息泄漏。显示 OPTIMUS 的动态硬件资源分区能力可以协同优化 MI6 和 IRONHIDE 架构的性能和安全性。它实现了应用级粒度的确定性资源分配，并限制了硬件重新配置的次数，以确保通过定时和终止通道进行有限的信息泄漏。OPTIMUS 的动态硬件资源分区能力被证明可以协同优化 MI6 和 IRONHIDE 架构的性能和安全性。