Vulnerabilities in Synchronous IPC Designs

• Authors: Jonathan S. Shapiro
• Venue: SP '03 Proceedings of the 2003 IEEE Symposium on Security and Privacy
• Year: 2003

Recent advances in interprocess communication (IPC)performance have been exclusively based on thread-migratingIPC designs. Thread-migrating designs assumethat IPC interactions are synchronous, and that user-levelexecution will usually resume with the invoked process(modulo preemption). This IPC design approach offersshorter instruction path lengths, requires fewer locks, hassmaller instruction and data cache footprints, dramaticallyreduces TLB overheads, and consequently offershigher performance and lower timing variance than previousIPC designs. With care, it can be performed as anatomic unit of operation.While the performance of thread-migrating IPC hasbeen examined in detail, the vulnerabilities implicit insynchronous IPC designs have not been examined indepth in the archival literature, and their implications forIPC design have been actively misunderstood in at leastone recent publication. In addition to performance, asound IPC design must address concerns of asymmetrictrust and reproducibility and provide support for dynamicpayload lengths. Previous IPC designs, including thoseof EROS, Mach, L4, Flask, and Pebble, satisfy only two ofthese three requirements.In this paper, we show how these three design objectivescan be met simultaneously. We identify the conflictof requirements and illustrate how their collision arisesin two well-documented IPC architectures: L4 and EROS.We then show how all three design objectives are simultaneouslymet in the next generation EROS IPC system.