基本信息

宋威  男    中国科学院信息工程研究所
电子邮件： songwei@iie.ac.cn
通信地址： 北京市海淀区杏石口路80号，益园文化创意产业基地C2楼，中国科学院信息工程研究所
邮政编码： 100195

研究领域

中国科学院信息工程研究所，信息安全国家重点实验室，副研究员，博士生导师。

中国科学院率先行动BR计划青年俊才C类入选者。
曾是剑桥大学计算机学院博士后（2014-2017），lowRISC项目硬件负责人（2014-2017），曼彻斯特大学计算机博士（2011）。


​个人主页    个人简历


研究方向：针对安全的编译器优化，安全处理器流水线和缓存架构，基于RISC-V的安全处理器设计

如果对我的研究方向感兴趣，希望报考研究生（硕士、直博、普博），请直接写信联系。


当前的研究项目：

  • 基于标签内存(tagged memory)的处理器新架构用以防御控制流劫持攻击。
        当前防御控制流劫持(control-flow hijacking)的方法主要是依赖于编译软件静态分析的控制流完整性(CFI)检查，这种方法需要对软件进行插桩(在每一个函数跳转时插入安全检查代码)。插桩直接导致软件执行性能的下降。
        利用硬件管理的标签内存，可以在软件执行的同时并行检查函数跳转的安全性，极大降低CFI检查的性能开销。
        研究所涉及的内容：中高性能处理器流水线的安全加固（计算机体系结构、集成电路设计）；处理器功能验证（RISC-V汇编语言、GCC/LLVM编译器的使用、嵌入式系统编程）；编译器对标签内存的自动支持（GCC/LLVM编译器后端移植，链接器/加载器的修改，Linux操作系统内核）。
  • 新一代的随机缓存结构来抵御缓存侧信道攻击。
        使用恶意代码构造软件缓存侧信道攻击是当前计算机系统信息泄露攻击的主要方式，也是众多复杂攻击的关键步骤。最近的研究发现，利用动态修改缓存内数据的分布可以有效地阻止缓存侧信道攻击。该项目研究可用于中高性能多核服务器中一致性缓存的动态数据分布随机化方法。
        研究所涉及的内容：一致性缓存的结构（计算机体系结构、集成电路设计）；一致性缓存的行为及模型（C++编程）；缓存侧信道攻击研究（C/C++、x86/ARM/RISC-V汇编、Linux/Windows操作系统）；算法分析（数据结构、概率与统计）。
  • 针对处理器系统（处理器硬件、操作系统和编译器）的漏洞测试集研发。
        现有的安全测试集主要测试软件的安全漏洞，关于处理器安全的研究急需一套针对处理器和计算机底层软件系统的漏洞测试集。本项目就是从简单的测试开始，编写和完善一套针对安全处理器系统的测试集。
        研究所涉及的内容：各种攻击方法的研究（软件攻击、计算机算法、操作系统）；测试程序的编写（C/C++、x86/ARM/RISC-V汇编，GCC/LLVM的高级使用）；测试集的集成（python）。

研究经历

2017年11月—至今，副研究员，中国科学院信息工程研究所
2014年11月—2017年10月，博士后副研究员，英国剑桥大学计算机学院
2011年10月—2014年10月，博士后副研究员，英国曼彻斯特大学计算机学院                                     
2007年9月—2011年7月，博士（英国EPSRC全奖），计算机，英国曼彻斯特大学计算机学院
2005年9月—2008年8月硕士，自动化，北京工业大学电子信息与控制工程学院
2001年9月—2005年8月学士，自动化，北京工业大学电子信息与控制工程学院


出版信息


Secure Computer Architecture

  • Wei Song, Boya Li, Zihan Xue , Zhenzhen Li, Wenhao Wang, Peng Liu. Randomized last level caches are still vulnerable to cache side-channel attacks! But we can fix it. IEEE Symposium on Security and Privacy (S&P), May 2021.

  • Wei Song and Peng Liu. Dynamically finding minimal eviction sets can be quicker than you think for side-channel attacks against the LLC. In Proc. of the 22nd International Symposium on Research in Attacks, Intrusions and Defenses (RAID), Beijing, China, September 2019.

  • Jun Zhang, Rui Hou, Wei Song, Sally A. McKee, Zhen Jia, Chen Zheng, Mingyu Chen, Lixin Zhang, and Dan Meng. RAGuard: An efficient and user-transparent hardware mechanism against ROP attacks. ACM Transactions on Architecture and Code Optimization (TACO), vol. 15, no. 4, pp. 50:1-50:21, 2019.

  • Jianping Zhu, Wei Song, Ziyuan Zhu, Jiameng Ying, Boya Li, Bibo Tu, Gang Shi, Rui Hou, and Dan Meng. CPU security benchmark. In Proc. of the 1st Workshop on Security-Oriented Designs of Computer Architectures and Processors, Toronto, ON, Canada, pp. 8–14, 2018.

  • Jun Zhang, Rui Hou, Wei Song, Zhiyuan Zhan, Boyan Zhao, Mingyu Chen, and Dan Meng. Stateful forward-edge CFI enforcement with Intel MPX. In CCF TCArch Bienneial Conference on Advanced Computer Architecture (ACA), Yingko, Liaoning, China, August 2018.

Asynchronous Network-on-Chip, VLSI

  • Guangda Zhang, Wei Song, Jim Garside, Javier Navaridas and Zhiying Wang. Handling physical-layer deadlock caused by permanent faults in quasi-delay-insensitive network-on-chip. IEEE Transactions on Very Large Scale Integration Systems (TVLSI), vol. 25, no. 11, pp. 3152–3165, 2017.

  • Guangda Zhang, Jim Garside, Wei Song, Javier Navaridas and Zhiying Wang. Deadlock recovery in asynchronous networks on chip in the presence of transient faults. In Proc. of International Symposium on Asynchronous Circuits and Systems (ASYNC), Silicon Valley, California, US, pp. 100–107, May 2015.

  • Guangda Zhang, Wei Song, Jim Garside, Javier Navaridas and Zhiying Wang. Protecting QDI interconnects from transient faults using delay-insensitive redundant check codes. Microprocessors and Microsystems, vol. 38, no. 8, pp. 826–842, 2014.

  • Guangda Zhang, Wei Song, Jim Garside, Javier Navaridas and Zhiying Wang. An asynchronous SDM network-on-chip tolerating permanent faults. In Proc. of International Symposium on Asynchronous Circuits and Systems (ASYNC), Potsdam, Germany, pp. 9–16, May 2014.

  • Wei Song, Guangda Zhang and Jim Garside. On-line detection of the deadlocks caused by permanently faulty links in quasi-delay insensitive networks on chip. In Proc. of International Conference of the Great Lakes Symposium on VLSI (GLSVLSI), Houston, Texas, USA, pp. 211–216, May 2014.

  • Guangda Zhang, Wei Song, Jim Garside, Javier Navaridas and Zhiying Wang. Transient fault tolerant QDI interconnects using redundant check code. In Proc. of EUROMICRO Conference on Digital System Design (DSD), Santander, Spain, pp. 3–10, September 2013.

  • Wei Song, Doug Edwards, Jim Garside and William J. Bainbridge. Area efficient asynchronous SDM routers using 2-stage Clos switches. In Proc. of Design, Automation & Test in Europe (DATE), Dresden, Germany, pp. 1495–1500, March 2012. 

  • 宋威, Doug Edwards. 异步片上网络研究综述. 计算机辅助设计与图形学学报, 2012, 24(6): 699–709. 

  • Wei Song and Doug Edwards. Asynchronous spatial division multiplexing router. Microprocessors and Microsystems, vol. 35, no. 2, pp. 85–97, 2011.

  • Wei Song, Doug Edwards, Zhenyu Liu and Sohini Dasgupta. Routing of asynchronous Clos networks. IET Computers & Digital Techniques, vol. 5, no. 6, pp. 452–467, 2011.

  • Wei Song and Doug Edwards. An asynchronous routing algorithm for Clos networks. In Proc. of International Conference on Application of Concurrency to System Design (ACSD), Braga, Portugal, pp. 67–76, 2010.

  • Wei Song and Doug Edwards. A low latency wormhole router for asynchronous on-chip networks. In Proc. of Asia and South Pacific Design Automation Conference (ASP-DAC), Taipei, ROC, pp. 437–443, 2010.

  • Wei Song and Doug Edwards. Building asynchronous routers with independent sub-channels. In Proc. of International Symposium on SoC, Tampere, Finland, pp. 48–51, 2009.

  • Wei Song, Doug Edwards, Jose Luis Nunez-Yanez, and Sohini Dasgupta. Adaptive stochastic routing in fault-tolerant on-chip networks. In Proc. of International Symposium on Networks-on-Chip (NoCS), San Diego, USA, pp. 32–37, 2009. 

FPGA, VLSI

  • Wei Song, Dirk Koch, Mikel Lujan and Jim Garside. Parallel hardware merge sorter. In Proc. of International Symposium on Field-Programmable Custom Computing Machines (FCCM), Washington DC, United States, pp. 95–102, May 2016.

  • Oriol Arcas Abella, Geoffrey Ndu, Nehir Sonmez, Mohsen Ghasempour, Adria Armejach, Javier Navaridas, Wei Song, John Mawer, Adrian Cristal, and Mikel Lujan. An empirical evaluation of high-level synthesis languages and tools for database acceleration. In Proc. of International Conference on Field Programmable Logic and Applications (FPL), Munich, Germany, pps. 8, September 2014.

  • 宋威, 方穗明, 姚丹, 张立超, 钱程. 多FPGA的时钟同步. 计算机工程, 2008, 34(7): 245–247. 宋威, 方穗明. 基于BUFGMUX与 DCM的FPGA时钟电路设计. 现代电子技术, 2006, 29(2): 141–143. 

  •  Electronic Design Automation, VLSI

  • Wei Song, Jim Garside and Doug Edwards. Automatic data path extraction in large-scale register-transfer level designs. In Proc. of IEEE International Symposium on Circuits and Systems (ISCAS), Melbourne, Australia, pp. 377–380, June 2014.

  • Wei Song and Jim Garside. Automatic controller detection for large scale RTL designs. In Proc. of EUROMICRO Conference on Digital System Design (DSD), Santander, Spain, pp. 884–851, September 2013

CANopen, Embedded Systems

  • 徐喆, 闫士珍, 宋威, 张卓. 基于MC9S12DP512和μC/OS-II的CANopen主站开发. 计算机工程与科学, 2009, 31(5): 118–120. 

  • 徐喆, 闫士珍, 宋威. 基于散列表的CANopen对象字典的设计. 计算机工程, 2009, 35(8): 44–46.

  • 宋威, 方穗明, 张明杰, 徐喆. 任务调度在CANopen主站设计中的应用. 计算机测量与控制, 2008(16): 558–560.

  • Wei Song, Shizhen Yan, Zhe Xu, and Suiming Fang. Transplantable CANopen master based on non-preemptive task scheduler. In Proc. of International Conference on Automation and Logistics (ICAL), pp. 557–562, 2007.

Thesis and Dissertations

  • Wei Song. Spatial parallelism in the routers of asynchronous on-chip networks. PhD Thesis, School of Computer Science, the University of Manchester, Manchester, UK, 2011. 

  •  宋威. CANopen现场总线应用层协议主站的开发与实现. 工学硕士学位论文, 电子信息与控制工程学院, 北京工业大学, 北京, 中国, 2008. 

  •  宋威. 802.11g无线网卡Baseband的FPGA验证和接口设计. 学士毕业论文, 电子信息与控制工程学院, 北京工业大学, 北京, 中国, 2005. 

 Patent  

  • 徐喆, 闫士珍, 宋威, 余春暄, 段建民, 张明杰. 一种实现CANopen主站的方法. 中国发明专利, 申请号200810056824.5, 专利号CN101222510B, 2010. 

Non-refereed Papers 

  • Wei Song, Rui Hou, and Dan Meng. Defeating the recent AnC attack by simply hashing the cache indexes — implemented in a BOOM SoC. In 8th RISC-V Workshop, Barcelona, Spain, May 2018. 

  • Wei Song, Alex Bradbury, and Robert Mullins. Towards general purpose tagged memory. In 2nd RISC-V Workshop, Berkeley, CA, US, June 2015. 

  • Wei Song and Doug Edwards. Using Clos switches in area efficient asynchronous SDM routers. In Proc. of the UK Electronics Forum, Manchester, UK, July 2011. 

  • Wei Song and Doug Edwards. Improving the throughput of asynchronous on-chip networks with SDM. In Proc. of the UK Electronics Forum, Newcastle, UK, June 2010. 

  • Wei Song and Doug Edwards. Channel Slicing: a way to build fast routers for asynchronous NoCs. In Proc. of the UK Asynchronous Forum, Bristol, UK, September 2009. 

  • Wei Song and Doug Edwards. A dynamic link allocation router. In Proc. of the UK Asynchronous Forum, Manchester, UK, September 2008. 

  • 宋威. C语言实现MATLAB 6.5中M文件的方法. 计算机与信息技术, 2004, 7(12): 57–58.