{"id":106979,"date":"2023-03-01T12:48:41","date_gmt":"2023-03-01T10:48:41","guid":{"rendered":"https:\/\/prohoster.info\/?p=106979"},"modified":"2023-03-01T13:43:17","modified_gmt":"2023-03-01T11:43:17","slug":"microsoft-otkryl-cheriot-apparatnoe-reshenie-dlya-povysheniya-bezopasnosti-koda-na-yazyke-si","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/microsoft-otkryl-cheriot-apparatnoe-reshenie-dlya-povysheniya-bezopasnosti-koda-na-yazyke-si","title":{"rendered":"Microsoft ka hapur CHERIoT, nj\u00eb zgjidhje harduerike p\u00ebr rritjen e siguris\u00eb s\u00eb kodit n\u00eb gjuh\u00ebn C","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Kompania Microsoft hapi ndihm\u00ebn e saj t\u00eb lidhur me projektin CHERIoT (Capability Hardware Extension to RISC-V p\u00ebr Internetin e Things), i cili ka si q\u00ebllim parandalimin e problemeve me sigurin\u00eb n\u00eb kodin ekzistues t\u00eb shkruar n\u00eb gjuh\u00ebt C dhe C++. CHERIoT ofron nj\u00eb zgjidhje q\u00eb lejon mbrojtjen e bazave ekzistuese t\u00eb kodit n\u00eb C\/C++ pa nevoj\u00ebn p\u00ebr rinovimin e tyre. Mbrojtja realizohet p\u00ebrmes p\u00ebrdorimit t\u00eb nj\u00eb kompajleri t\u00eb modifikuar, i cili p\u00ebrdor nj\u00eb grup t\u00eb posa\u00e7\u00ebm t\u00eb instrukcioneve t\u00eb zgjeruara t\u00eb procesor\u00ebve (ISA), t\u00eb cilat monitorojn\u00eb aksesin n\u00eb memorie n\u00eb nivelin e harduerit, verifikojn\u00eb sakt\u00ebsin\u00eb e pun\u00ebs me treguesit dhe sigurojn\u00eb izolim t\u00eb blloqeve t\u00eb kodit. <\/p>\n

Projekti \u00ebsht\u00eb krijuar me nj\u00eb v\u00ebshtrim ndaj natyr\u00ebs s\u00eb ul\u00ebt t\u00eb gjuh\u00ebs C, e cila shnd\u00ebrrohet n\u00eb burim gabimesh gjat\u00eb pun\u00ebs me memorie, duke \u00e7uar n\u00eb probleme t\u00eb tilla si tejkalimi i duk\u00ebs, aksesimi i memories s\u00eb liruar, dereferencimi i treguesve ose \u00e7lirimi i dyfisht\u00eb i memories. Praktika tregon se madje edhe korporatat e m\u00ebdha, si Google dhe Microsoft, t\u00eb cilat kan\u00eb nj\u00eb politik\u00eb strikte t\u00eb rishikimit t\u00eb ndryshimeve dhe p\u00ebrdorin metoda moderne t\u00eb zhvillimit dhe mjete t\u00eb analizes statike, nuk mund t\u00eb garantojn\u00eb munges\u00ebn e gabimeve gjat\u00eb pun\u00ebs me memorie (p.sh., rreth 70% e dob\u00ebsive n\u00eb produktet softuerike t\u00eb Microsoft dhe Google shkaktohen nga ndihma e pasigurt me memorien). <\/p>\n

Problemi mund t\u00eb zgjidhet duke p\u00ebrdorur gjuh\u00ebprogramimi q\u00eb garantojn\u00eb sigurin\u00eb n\u00eb pun\u00ebn me memorie, ose duke p\u00ebrdorur mb\u00ebshtetje me kontrolle shtes\u00eb, p\u00ebr shembull, p\u00ebrmes p\u00ebrdorimit t\u00eb treguesve t\u00eb tipit MiraclePtr (raw_ptr), i cili realizon kontrolle shtes\u00eb p\u00ebr aksesin n\u00eb zonat e memories s\u00eb liruar. Por metodat e tilla jan\u00eb m\u00eb t\u00eb p\u00ebrshtatshme p\u00ebr kodin e ri, nd\u00ebrsa projektet ekzistuese n\u00eb C\/C++ jan\u00eb t\u00eb v\u00ebshtira p\u00ebr t'u rinovuar, sidomos n\u00ebse ato jan\u00eb t\u00eb destinuara p\u00ebr t\u00eb funksionuar n\u00eb mjedise me burime t\u00eb kufizuara, si sistemet e integruara dhe pajisjet e Internetit t\u00eb Gj\u00ebrave. <\/p>\n

Komponent\u00ebt harduerik\u00eb CHERIoT jan\u00eb t\u00eb dizajnuar si nj\u00eb mikroprocesor mbi baz\u00ebn e arkitektur\u00ebs RISC-V, q\u00eb implementon arkitektur\u00ebn e sigurt\u00eb t\u00eb procesorit CHERI (Capability Hardware Extension to RISC-V), e cila ofron nj\u00eb model t\u00eb menaxhuar t\u00eb aksesit n\u00eb memorie mbi baz\u00ebn e \"capability\" (\u00e7do operacion leximi dhe shkruajtur n\u00eb memoria autorizohet). Duke u mb\u00ebshtetur n\u00eb arkitektur\u00ebn e grupit t\u00eb komandave (ISA) t\u00eb ofruar nga CHERIoT, \u00ebsht\u00eb nd\u00ebrtuar nj\u00eb model softuerik q\u00eb garanton sigurin\u00eb e pun\u00ebs me memorien n\u00eb nivelin e objekteve t\u00eb ve\u00e7anta, duke ofruar mbrojtje nga akseset n\u00eb memorien e liruar tashm\u00eb dhe duke implementuar nj\u00eb sistem t\u00eb leht\u00eb t\u00eb izolimit t\u00eb aksesit n\u00eb memorie. Ky model mbrojtjeje softuerike reflektohet drejtp\u00ebrdrejt n\u00eb modelin gjuh\u00ebsor C\/C++, q\u00eb e b\u00ebn t\u00eb mundur aplikimin e tij p\u00ebr mbrojtjen e aplikacioneve ekzistuese (duhet vet\u00ebm ripaketime dhe ekzekutim n\u00eb harduerin q\u00eb mb\u00ebshtet ISA CHERIoT). <\/p>\n

Zgjidhja e propozuar lejon bllokimin e gabimeve q\u00eb shkaktojn\u00eb daljen jasht\u00eb kufijve t\u00eb objekteve n\u00eb memorje, nuk lejon shk\u00ebmbimin e treguesve (t\u00eb gjith\u00eb treguesit duhet t\u00eb krijohen nga treguesit ekzistues), ndjek qasjen n\u00eb memorje pas \u00e7lirimit (\u00e7do qasje n\u00eb memorje p\u00ebrmes nj\u00eb treguesi t\u00eb pavlefsh\u00ebm ose nj\u00eb treguesi q\u00eb referon nj\u00eb objekt t\u00eb \u00e7liruar \u00e7on n\u00eb gjenerimin e nj\u00eb p\u00ebrjashtimi). P\u00ebr shembull, p\u00ebrdorimi i CHERIoT lejon implementimin automatik t\u00eb kontrollit t\u00eb kufijve, ndjekjen e jet\u00ebs s\u00eb zonave t\u00eb memorjes dhe sigurin\u00eb e treguesve n\u00eb komponent\u00ebt q\u00eb p\u00ebrpunojn\u00eb t\u00eb dh\u00ebna t\u00eb pasigurta, pa b\u00ebr\u00eb ndryshime n\u00eb kod. <\/p>\n

Projekti p\u00ebrfshin specifikimin e arkitektur\u00ebs s\u00eb zgjeruar t\u00eb setit t\u00eb komandave CHERIoT, nj\u00eb implementim referent t\u00eb CPU 32-bit RISC-V me mb\u00ebshtetje p\u00ebr ISA CHERIoT dhe nj\u00eb mjet t\u00eb modifikuar LLVM. Skemat e prototipit t\u00eb CPU-s\u00eb dhe p\u00ebrshkrimet e blloqeve harduerike n\u00eb gjuh\u00ebn Verilog shp\u00ebrndahen n\u00ebn licenc\u00ebn Apache 2.0. Si baz\u00eb p\u00ebr CPU-n\u00eb, \u00ebsht\u00eb p\u00ebrdorur b\u00ebrthama Ibex nga projekti lowRISC. Modeli i kodit CHERIoT ISA \u00ebsht\u00eb p\u00ebrcaktuar n\u00eb gjuh\u00ebn Sail dhe shp\u00ebrndahet n\u00ebn licenc\u00ebn BSD. <\/p>\n

Shtes\u00eb \u00ebsht\u00eb propozuar nj\u00eb prototip i sistemit operativ n\u00eb koh\u00eb reale CHERIoT RTOS, q\u00eb ofron mund\u00ebsin\u00eb e izolimit t\u00eb kompartmenteve (compartment) edhe n\u00eb sisteme t\u00eb inkorporuara me 256 MB RAM. Kodi i CHERIoT RTOS \u00ebsht\u00eb shkruar n\u00eb gjuh\u00ebn C++ dhe shp\u00ebrndahet n\u00ebn licenc\u00ebn MIT. N\u00eb form\u00ebn e kompartmenteve jan\u00eb formuar komponent\u00ebt baz\u00eb t\u00eb sistemit operativ, si\u00e7 jan\u00eb bootloaderi, planifikuesi dhe sistemi i ndarjes s\u00eb memories. <\/p>\n

Kompartamenti n\u00eb CHERIoT RTOS paraqet nj\u00eb kombinim t\u00eb izoluar t\u00eb kodit dhe variablave globale, q\u00eb ngjan me nj\u00eb bibliotek\u00eb t\u00eb ndar\u00eb, por ndryshe nga kjo e fundit, mund t\u00eb ndryshoj\u00eb gjendjen e tij (mutable) dhe t\u00eb ekzekutohet n\u00eb nj\u00eb kontekst t\u00eb ve\u00e7ant\u00eb sigurie. Asnj\u00eb kod nga jasht\u00eb nuk mund t\u00eb kaloj\u00eb kontrollin n\u00eb kodin brenda kompartmentit dhe t\u00eb ket\u00eb qasje n\u00eb objektet, p\u00ebrve\u00e7 se duke iu drejtuar pikave t\u00eb ve\u00e7anta t\u00eb hyrjes dhe duke p\u00ebrdorur tregues p\u00ebr objektet, t\u00eb cilat jan\u00eb dh\u00ebn\u00eb qart\u00eb gjat\u00eb thirrjes s\u00eb kompartmentit tjet\u00ebr. P\u00ebr kodin dhe objektet globale n\u00eb kompartment, garantohen integriteti dhe konfidencialiteti.
\n
Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043e\u0442\u043a\u0440\u044b\u043b\u0430 \u043d\u0430\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c CHERIoT (Capability Hardware Extension to RISC-V for Internet of Things), \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u043c \u043d\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c \u043a\u043e\u0434\u0435 \u043d\u0430 \u044f\u0437\u044b\u043a\u0430\u0445 C \u0438 \u0421++. CHERIoT \u043f\u0440\u0435\u0434\u043b\u0430\u0433\u0430\u0435\u0442 \u0440\u0435\u0448\u0435\u043d\u0438\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0435 \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u043a\u043e\u0434\u043e\u0432\u044b\u0435 \u0431\u0430\u0437\u044b \u043d\u0430 \u0421\/C++ \u0431\u0435\u0437 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0438\u0445 \u043f\u0435\u0440\u0435\u0440\u0430\u0431\u043e\u0442\u043a\u0438. \u0417\u0430\u0449\u0438\u0442\u0430 \u0440\u0435\u0430\u043b\u0438\u0437\u0443\u0435\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0435\u0433\u043e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0440\u0430\u0441\u0448\u0438\u0440\u0435\u043d\u043d\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106979","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Microsoft hap CHERIoT, nj\u00eb zgjidhje harduerike p\u00ebr p\u00ebrmir\u00ebsimin e siguris\u00eb s\u00eb kodit n\u00eb gjuh\u00ebn C | ProHoster","description":"Kompania Microsoft ka hapur punimet e saj, t\u00eb lidhura me projektin CHERIoT (Capability Hardware Extension to RISC-V for Internet of Things), e cila ka si q\u00ebllim bllokimin e problemeve t\u00eb siguris\u00eb n\u00eb kodin ekzistues t\u00eb shkruar n\u00eb gjuh\u00ebt C.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/news\/microsoft-otkryl-cheriot-apparatnoe-reshenie-dlya-povysheniya-bezopasnosti-koda-na-yazyke-si","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Microsoft \u043e\u0442\u043a\u0440\u044b\u043b CHERIoT, \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u0434\u0430 \u043d\u0430 \u044f\u0437\u044b\u043a\u0435 \u0421\u0438 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Microsoft \u043e\u0442\u043a\u0440\u044b\u043b\u0430 \u043d\u0430\u0440\u0430\u0431\u043e\u0442\u043a\u0438, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043f\u0440\u043e\u0435\u043a\u0442\u043e\u043c CHERIoT (Capability Hardware Extension to RISC-V for Internet of Things), \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u043c \u043d\u0430 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u0432 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c \u043a\u043e\u0434\u0435 \u043d\u0430 \u044f\u0437\u044b\u043a\u0430\u0445 C.","og:url":"https:\/\/prohoster.info\/sq\/blog\/news\/microsoft-otkryl-cheriot-apparatnoe-reshenie-dlya-povysheniya-bezopasnosti-koda-na-yazyke-si","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-01T10:48:41+00:00","article:modified_time":"2023-03-01T11:43:17+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/106979","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=106979"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/106979\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=106979"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=106979"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=106979"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}