Paper-Conference

μSCOPE: A Methodology for Analyzing Least-Privilege Compartmentalization in Large Software Artifacts
By prioritizing simplicity and portability, least-privilege engineering has been an afterthought in OS design, resulting in monolithic …
PDF Cite DOI
DeepMatch: practical deep packet inspection in the data plane using network processors
Restricting data plane processing to packet headers precludes analysis of payloads to improve routing and security decisions. DeepMatch …
PDF Cite DOI
Protecting the Stack with Metadata Policies and Tagged Hardware
The program call stack is a major source of exploitable security vulnerabilities in low-level, unsafe languages like C. In conventional …
PDF Cite Video DOI
The Dover inherently secure processor
The Dover inherently secure processor being developed at Draper extends a conventional CPU (we use an open-source RISC-V …
PDF Cite DOI
Architectural Support for Software-Defined Metadata Processing
Optimized hardware for propagating and checking software-programmable metadata tags can achieve low runtime overhead. We generalize …
PDF Cite DOI
RotoRouter: Router Support for Endpoint-Authorized Decentralized Traffic Filtering to Prevent DoS Attacks
RotoRouter addresses Denial-of-Service (DoS) attacks on networks with a novel protocol and router implementation. Sets of RotoRouters …
PDF Cite
A verified information-flow architecture
SAFE is a clean-slate design for a highly secure computer system, with pervasive mechanisms for tracking and limiting information …
PDF Cite DOI
Low-Fat Pointers: Compact Encoding and Efficient Gate-Level Implementation of Fat Pointers for Spatial Safety and Capability-based Security
Referencing outside the bounds of an array or buffer is a common source of bugs and security vulnerabilities in today’s software. …
PDF Cite DOI