Valero "CODOMs: Protecting Software with Code-centric Memory Domains", ISCA' 14

Today’s complex software systems are neither secure nor reliable. The rudimentary software protection primitives pro-vided by current hardware forces systems to run many distrust-ing software components (e.g., procedures, libraries, plugins, modules) in the same protection domain, or otherwise suffer degraded performance from address space switches. We present CODOMs (COde-centric memory DOMains), a novel architecture that can provide finer-grained isolation between software components with effectively zero run-time overhead, all at a fraction of the complexity of other ap-proaches. An implementation of CODOMs in a cycle-accurate full-system x86 simulator demonstrates that with the right hardware support, finer-grained protection and run-time per-formance can peacefully coexist. 1