Abstract
Industrial control systems need strong security and performance guarantees. Current digital systems may be vulnerable to a variety of low-level attacks that exploit common weaknesses such as out-of-bounds read/write, access of resource using incompatible type, and de-serialization of untrusted data. These types of weaknesses appear in the 2024 CWE Top 10 KEV Weaknesses List. In this article, we introduce the binary implementation (BHPol) of the HPol hierarchical security policy framework. BHPol enables the fast firmware-level declaration and enforcement of security polices on-chip. A BHPol enabled digital processor checks each low-level instruction against a predefined and static set of security policies using associative memory. Requests not allowed by the policy are denied.