Information Flow Confidentiality and Integrity on a Rocket RISC-V SoC
summary
Dover implements per-word, per-instruction taint tracking in hardware on a Rocket RISC-V SoC, grabbing runtime instruction trace and mapping RISC‑V ops to abstract shapes checked against a rule cache. Confidentiality prevents private data from being written to public memory unless declassified (for example, encrypted); integrity revokes “trusted” status on any modification. Demo covers protecting an eFPGA bitstream and AES key material; metadata uses per-64‑bit tags with about 25% memory overhead.
AI-written summary · about
chapters (10)
- 0:00Introduction to talk
- 0:22CIA triad and compartmentalization
- 1:24Fine-grained information flow control
- 6:59CoreGuard technology overview
- 10:27Confidentiality and integrity on SoC
- 13:34Policy enforcement and metadata flow
- 16:44Code examples and policy rules
- 17:26Comparison with compartmentalization
- 20:13Fine-grained vs coarse-grained security
- 21:38Q&A session
related talks
27mControl Flow Integrity on RISC-V
18mCPU Security in the Context of RISC-V
01h 05mConfidential Computing for RISC-V-based Platforms
24mSystem Level Security Verification of RISC V Based SoCs
18mIntroducing RISC-V Confidential Computing for IoT Devices
23mTowards Scalable Confidential Computing on RISC-V
35mControl Flow Integrity on RISC-V Linux
52mEnabling New Security Frontiers: Deep-Dive Into Implementing Confidential Computing on RISC-V