SITI-Wrap: Secure Integrity for Third-Party IOMMUs

Abstract

As general-purpose processors continue to face scaling limitations, system-on-chip (SoC) designs grow in popularity due to their lower power consumption and smaller space complexity. For more flexible SoC designs, primary SoC manufacturers incorporate third-party intellectual property (IP) to satisfy system needs, leading to higher modularity. However, reliance on third-party IPs compromises the overall security of the design, as manufacturers can no longer fully guarantee its integrity. To protect the system against untrusted IPs, the I/O memory management unit (IOMMU) provides data isolation by virtualizing the memory address space through page table walks. Systems leveraging IOMMUs manufactured by untrusted vendors could become malicious or buggy, potentially compromising the data isolation and exposing the system to security vulnerabilities which may avoid detection from standard functional verification. In this work, we propose SITI-Wrap, a novel hardware design solution that allows SoCs to safely incorporate untrusted third-party IOMMUs. SITI-Wrap guarantees the integrity of translation requests and other critical operations by introducing a novel and secure hardware wrapper design which ensures correct IOMMU functionality without software modification. We accomplish this through the use of local hardware structures within the wrapper, responsible for verifying the various stages of all IOMMU operations. Our evaluation results show that SITI-Wrap adds negligible performance overhead on average (< 0.1%) for co-processed workloads by using minimally-sized data structures which maximize parallel operations.