Reimagining the Usermode Process Space by Utilizing Hardware-Enforced Sub-Process Isolation

The traditional x86 memory model inherently lacks enforceable trust boundaries, allowing unverified executables and libraries to share process memory. This model assumes the integrity of the operating system and toolchain, yet it remains susceptible to code injection, unauthorized execution, and privilege escalation attacks. This position paper proposes a hardware-enforced, sub-process isolation model that mandates digitally signed executables, ensuring runtime verification and execution integrity. We introduce a Trust-by-Choice execution framework, enabling executables to dynamically assess and regulate dependencies, mitigating supply chain threats. Additionally, we introduce compiler-assisted memory isolation by integrating Trusted Execution Environments (TEEs) into the $\mathbf{C}$ toolchain, enhancing confidentiality and integrity while also suppressing arbitrary code execution between executable modules. Finally, we introduce Share-by-default and Share-by-Choice models of data isolation. By embedding trust enforcement into hardware, our approach eliminates reliance on OS-based security, provides least privilege enforcement, and applies zero trust principles at the architectural level. This model provides a scalable, backward-compatible security framework for modern computing environments.