Spolo\u010dnos\u0165 Microsoft otvorila pr\u00edpravy na projekt CHERIoT (Capability Hardware Extension to RISC-V for Internet of Things), ktor\u00fd je zameran\u00fd na rie\u0161enie probl\u00e9mov so zabezpe\u010den\u00edm existuj\u00faceho k\u00f3du nap\u00edsan\u00e9ho v jazykoch C a C++. CHERIoT pon\u00faka rie\u0161enie, ktor\u00e9 umo\u017e\u0148uje chr\u00e1ni\u0165 existuj\u00face k\u00f3dov\u00e9 z\u00e1klady v C\/C++ bez potreby ich prepracovania. Ochrana sa implementuje prostredn\u00edctvom pou\u017eitia modifikovan\u00e9ho kompil\u00e1tora, ktor\u00fd vyu\u017e\u00edva \u0161peci\u00e1lnu roz\u0161\u00edren\u00fa sadu in\u0161trukci\u00ed procesora (ISA), ktor\u00e1 na hardv\u00e9rovej \u00farovni sleduje pr\u00edstup k pam\u00e4ti, overuje spr\u00e1vnos\u0165 pr\u00e1ce s ukazovate\u013emi a zabezpe\u010duje izol\u00e1ciu blokov k\u00f3du. <\/p>\n
Projekt bol vytvoren\u00fd s oh\u013eadom na to, \u017ee n\u00edzko\u00farov\u0148ov\u00e1 povaha jazyka C je zdrojom ch\u00fdb pri pr\u00e1ci s pam\u00e4\u0165ou, \u010do vedie k probl\u00e9mom ako prete\u010denie z\u00e1sobn\u00edka, pr\u00edstup k u\u017e uvo\u013enenej pam\u00e4ti, dereferencovanie ukazovate\u013eov alebo dvojit\u00e9 uvo\u013enenie pam\u00e4ti. Prax ukazuje, \u017ee aj ve\u013ek\u00e9 korpor\u00e1cie, ako Google a Microsoft, ktor\u00e9 maj\u00fa pr\u00edsnu politiku recenzovania zmien a pou\u017e\u00edvaj\u00fa modern\u00e9 met\u00f3dy v\u00fdvoja a n\u00e1stroje statickej anal\u00fdzy, nedok\u00e1\u017eu zaru\u010di\u0165 absenciu ch\u00fdb pri pr\u00e1ci s pam\u00e4\u0165ou (napr\u00edklad, pribli\u017ene 70% zranite\u013enost\u00ed v softv\u00e9rov\u00fdch produktoch Microsoftu a Googlu je sp\u00f4soben\u00fdch nebezpe\u010dnou pr\u00e1cou s pam\u00e4\u0165ou). <\/p>\n
Probl\u00e9m m\u00f4\u017ee by\u0165 vyrie\u0161en\u00fd pou\u017eit\u00edm programovac\u00edch jazykov, ktor\u00e9 zaru\u010duj\u00fa bezpe\u010dn\u00fa pr\u00e1cu s pam\u00e4\u0165ou, alebo obalov s dodato\u010dn\u00fdmi kontrolami, napr\u00edklad pou\u017eit\u00edm namiesto be\u017en\u00fdch ukazovate\u013eov typu MiraclePtr (raw_ptr), ktor\u00fd vykon\u00e1va dodato\u010dn\u00e9 kontroly pr\u00edstupu k uvo\u013enen\u00fdm oblastiam pam\u00e4ti. Av\u0161ak tak\u00e9to met\u00f3dy sa viacej hodia pre nov\u00fd k\u00f3d, zatia\u013e \u010do existuj\u00face projekty v C\/C++ je \u0165a\u017ek\u00e9 prepracova\u0165, najm\u00e4 ak s\u00fa ur\u010den\u00e9 na vykon\u00e1vanie v prostrediach s obmedzen\u00fdmi zdrojmi, ako s\u00fa zabudovan\u00e9 syst\u00e9my a zariadenia internetu vec\u00ed. <\/p>\n
Hardv\u00e9rov\u00e9 komponenty CHERIoT s\u00fa navrhnut\u00e9 ako mikrokontrol\u00e9r zalo\u017een\u00fd na architekt\u00fare RISC-V, ktor\u00fd implementuje zabezpe\u010den\u00fa procesorov\u00fa architekt\u00faru CHERI (Capability Hardware Extension to RISC-V). T\u00e1to architekt\u00fara poskytuje model riaden\u00e9ho pr\u00edstupu k pam\u00e4ti na z\u00e1klade \u201ecapability\u201c (ka\u017ed\u00e1 oper\u00e1cia \u010d\u00edtania a z\u00e1pisu do pam\u00e4te je autorizovan\u00e1). Na z\u00e1klade architekt\u00fary in\u0161truk\u010dnej sady (ISA) poskytovanej v CHERIoT je vybudovan\u00fd softv\u00e9rov\u00fd model, ktor\u00fd zaru\u010duje bezpe\u010dnos\u0165 pri pr\u00e1ci s pam\u00e4\u0165ou na \u00farovni jednotliv\u00fdch objektov, poskytuje ochranu pred pr\u00edstupom k u\u017e oslobodenej pam\u00e4ti a implementuje \u013eahk\u00fd syst\u00e9m izol\u00e1cie pr\u00edstupu k pam\u00e4ti. Tento softv\u00e9rov\u00fd model ochrany sa priamo odr\u00e1\u017ea v jazykovom modeli C\/C++, \u010do umo\u017e\u0148uje jeho aplik\u00e1ciu na ochranu existuj\u00facich aplik\u00e1ci\u00ed (vy\u017eaduje sa iba prekompil\u00e1cia a spustenie na hardv\u00e9ri, ktor\u00fd podporuje ISA CHERIoT). <\/p>\n
Navrhnut\u00e9 rie\u0161enie umo\u017e\u0148uje blokova\u0165 chyby, ktor\u00e9 sp\u00f4sobuj\u00fa prekro\u010denie hran\u00edc objektu v pam\u00e4ti, zabra\u0148uje podvrhovaniu ukazovate\u013eov (v\u0161etky ukazovatele musia poch\u00e1dza\u0165 z u\u017e existuj\u00facich ukazovate\u013eov), sleduje pr\u00edstup k pam\u00e4ti po jej uvo\u013enen\u00ed (ak\u00fdko\u013evek pr\u00edstup k pam\u00e4ti cez nespr\u00e1vny ukazovate\u013e alebo ukazovate\u013e odkazuj\u00faci na uvo\u013enen\u00fd objekt vedie k generovaniu v\u00fdnimky). Napr\u00edklad pou\u017eitie CHERIoT umo\u017e\u0148uje bez zmien v k\u00f3de realizova\u0165 automatick\u00fa kontrolu hran\u00edc, sledovanie \u017eivotnosti oblast\u00ed pam\u00e4te a zabezpe\u010di\u0165 integritu ukazovate\u013eov v komponentoch, ktor\u00e9 spracov\u00e1vaj\u00fa ned\u00f4veryhodn\u00e9 d\u00e1ta. <\/p>\n
Projekt obsahuje \u0161pecifik\u00e1ciu roz\u0161\u00edrenej architekt\u00fary sady in\u0161trukci\u00ed CHERIoT, referen\u010dn\u00fa implement\u00e1ciu 32-bitov\u00e9ho CPU RISC-V s podporou ISA CHERIoT a modifikovan\u00fd n\u00e1stroj LLVM. Sch\u00e9my prototypu CPU a popisy hardv\u00e9rov\u00fdch blokov v jazyku Verilog s\u00fa \u0161\u00edren\u00e9 pod licenciou Apache 2.0. Ako z\u00e1klad pre CPU bolo pou\u017eit\u00e9 jadro Ibex z projektu lowRISC. Model k\u00f3du CHERIoT ISA je definovan\u00fd v jazyku Sail a je \u0161\u00edren\u00fd pod licenciou BSD. <\/p>\n
Dodato\u010dne je predstaven\u00fd prototyp opera\u010dn\u00e9ho syst\u00e9mu re\u00e1lneho \u010dasu CHERIoT RTOS, ktor\u00fd poskytuje mo\u017enos\u0165 izol\u00e1cie kompartimentov (compartment) aj na embedded syst\u00e9moch s 256 MB RAM. K\u00f3d CHERIoT RTOS je nap\u00edsan\u00fd v jazyku C++ a \u0161\u00edri sa pod licenciou MIT. V podobe kompartimentov s\u00fa spracovan\u00e9 z\u00e1kladn\u00e9 komponenty OS, ako s\u00fa bootloader, pl\u00e1nova\u010d a syst\u00e9m spr\u00e1vy pam\u00e4te. <\/p>\n
Kompartm\u00e1n v CHERIoT RTOS predstavuje izolovan\u00fa kombin\u00e1ciu k\u00f3du a glob\u00e1lnych premenn\u00fdch, ktor\u00e1 pripom\u00edna zdie\u013ean\u00fa kni\u017enicu, ale na rozdiel od nej m\u00f4\u017ee meni\u0165 svoj stav (mutable) a sp\u00fa\u0161\u0165a\u0165 sa v samostatnom bezpe\u010dnostnom kontexte. \u017diadny k\u00f3d zvonka nem\u00f4\u017ee odovzda\u0165 ovl\u00e1danie k\u00f3du v kompartm\u00e1nu ani z\u00edska\u0165 pr\u00edstup k objektom, okrem volania \u0161peci\u00e1lne definovan\u00fdch vstupn\u00fdch bodov a pou\u017eitia ukazovate\u013eov na objekty, ktor\u00e9 s\u00fa explicitne predan\u00e9 pri volan\u00ed in\u00e9ho kompartm\u00e1nu. Pre k\u00f3d a glob\u00e1lne objekty v kompartm\u00e1ne je zaru\u010den\u00e1 integrita a d\u00f4vernos\u0165. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043e\u0442\u043a\u0440\u044b\u043b\u0430 \u043d\u0430\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c CHERIoT (Capability Hardware Extension to RISC-V for Internet of Things), \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u043c \u043d\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c \u043a\u043e\u0434\u0435 \u043d\u0430 \u044f\u0437\u044b\u043a\u0430\u0445 C \u0438 \u0421++. CHERIoT \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0440\u0435\u0448\u0435\u043d\u0438\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0435 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043a\u043e\u0434\u043e\u0432\u044b\u0435 \u0431\u0430\u0437\u044b \u043d\u0430 \u0421\/C++ \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0445 \u043f\u0435\u0440\u0435\u0440\u0430\u0431\u043e\u0442\u043a\u0438. \u0417\u0430\u0449\u0438\u0442\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0433\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106979","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Microsoft predstavil CHERIoT, hardv\u00e9rov\u00e9 rie\u0161enie na zv\u00fd\u0161enie bezpe\u010dnosti k\u00f3du nap\u00edsan\u00e9ho v jazyku C | ProHoster","description":"Spolo\u010dnos\u0165 Microsoft odhalila v\u00fdskum t\u00fdkaj\u00faci sa projektu CHERIoT (Capability Hardware Extension to RISC-V for Internet of Things), zameran\u00e9ho na blokovanie probl\u00e9mov s bezpe\u010dnos\u0165ou v existuj\u00facom k\u00f3de nap\u00edsanom v C.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/microsoft-otkryl-cheriot-apparatnoe-reshenie-dlya-povysheniya-bezopasnosti-koda-na-yazyke-si","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Microsoft \u043e\u0442\u043a\u0440\u044b\u043b CHERIoT, \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0434\u0430 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043e\u0442\u043a\u0440\u044b\u043b\u0430 \u043d\u0430\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c CHERIoT (Capability Hardware Extension to RISC-V for Internet of Things), \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u043c \u043d\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c \u043a\u043e\u0434\u0435 \u043d\u0430 \u044f\u0437\u044b\u043a\u0430\u0445 C.","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/microsoft-otkryl-cheriot-apparatnoe-reshenie-dlya-povysheniya-bezopasnosti-koda-na-yazyke-si","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-01T10:48:41+00:00","article:modified_time":"2023-03-01T11:43:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/106979","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=106979"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/106979\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=106979"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=106979"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=106979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n
Zdroj: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"