Nowadays, hardware security has become a serious concern for modern CPUs. State-of-the-art detection approaches rely heavily on trustworthy and intimate internal states, incurring significant design/operation overheads and additional risks to security and intellectual property. This article proposes an architecture called Jintide, which utilizes trusted external monitors to validate an untrusted CPU chip at runtime. This architecture records, replays, and analyzes the CPU’s IO and memory behavior with the architectural states. The Jintide simultaneously verifies whether the records are correctly replayed with the instruction set architecture and whether the records involve malicious behavior. Consequently, not only architectural but also micro-architectural threats can be detected. The Jintide adopts the states from the untrusted source because it has a built-in function to detect spurious states. The monitors comprise three types of chips (with 28-/40-nm TSMC technology): a tracer chip to record the behavior of IO ports, multiple tracer chips to record the behavior of DDR4 DIMMs, and a reconfigurable chip to verify these records with software states. As runtime external monitors, the Jintide would be especially suitable to constitute distributed large-scale clusters, which can amortize operation overheads. This scheme is effective in detecting pervasive hardware security issues, including vulnerabilities, backdoors, and hardware Trojans. The measured results show that a system composed of 300 000 Jintide CPUs containing Intel Xeon Skylake processors can detect over 99.8% of recognizable attacks at the cost of 0.98% performance loss. Hence, the Jintide is an extensible, low-cost, and effective solution to improve the hardware security of large-scale CPU clusters.

This article consists of a collection of slides from the author's conference presentation.

Discovering vulnerabilities in operating system (OS) kernels and patching them is crucial for OS security. However, there is a lack of effective kernel vulnerability detection tools, especially for closed-source OSes such as Microsoft Windows. In this paper, we present Digtool, an effective, binary-code-only, kernel vulnerability detection framework. Built atop a virtualization monitor we designed, Digtool successfully captures various dynamic behaviors of kernel execution, such as kernel object allocation, kernel memory access, thread scheduling, and function invoking. With these behaviors, Digtool has identified 45 zero-day vulnerabilities such as outof-bounds access, use-after-free, and time-of-check-to time-of-use among both kernel code and device drivers of recent versions of Microsoft Windows, including Windows 7 and Windows 10.