Enabling Practical Full System Containment

Abstract:

Acknowledging that modern computing systems are too complex to be vulnerability free, we advocate for a single, simple component that would quarantine the ill effects of compromised system components. Work on a system called TrustGuard has shown that it is feasible for a simple and pluggable hardware element, called the Sentry, to offer containment of untrusted hardware, by ensuring that the system only outputs results of correct execution of signed programs. TrustGuard’s original focus was to protect against hardware vulnerabilities and signed programs needed to be entirely trusted. This work extends TrustGuard’s checking scheme with a new programming model. This new model exposes the Sentry to programmers by allowing them to reduce the amount of code that is trusted and checked by the Sentry. We implemented a library for runtime integrity checking of key-value database operations to demonstrate the practicality of the enhanced checking scheme and exemplify how Sentry produces trusted output using untrusted applications, OS and hardware.

Reading list:

Books:

• Andrew W. Appel, Modern Compiler Implementation in ML. Cambridge University Press, 1998
• Ross J. Anderson. 2008. Security Engineering: A Guide to Building Dependable Distributed Systems (2 ed.). Wiley Publishing. (Chapters 3,4,5,11,16)
• John L. Hennessy and David A. Patterson. 2011. Computer Architecture, Fifth Edition: A Quantitative Approach (5th ed.). Morgan Kaufmann Publishers Inc., San Francisco, CA, USA

Papers:

• Riad S. Wahby, Max Howald, Siddharth J. Garg, Abhi Shelat, and Michael Walfish. Verifiable ASICs. In IEEE S&P 2016.
• Benjamin Braun, Ariel J. Feldman, Zuocheng Ren, Srinath Setty, Andrew J. Blumberg, and Michael Walfish. 2013. Verifying computations with state. In Proceedings of the Twenty-Fourth ACM Symposium on Operating Systems Principles (SOSP '13).
• G.E. Suh, D Clarke, B. Gassend, M. van Dijk, S. Devadas. AEGIS: architecture for tamper-evident and tamper-resistant processing. In Proceedings of the 17th annual international conference on Supercomputing, ICS’03
• T. M. Austin, "DIVA: a reliable substrate for deep submicron microarchitecture design," Microarchitecture, 1999. MICRO-32. Proceedings. 32nd Annual International Symposium on, Haifa, 1999
• A. Miller, M. Hicks, J. Katz, and E. Shi. Authenticated data structures, generically. In POPL 2014.
• Goodrich, Michael T., Roberto Tamassia, and Andrew Schwerin. "Implementation of an authenticated dictionary with skip lists and commutative hashing."  DISCEX'01, 2001.
• Premkumar T. Devanbu, Michael Gertz, Charles U. Martel, and Stuart G. Stubblebine. Authentic third-party data publication. In DBSec, volume 201 of IFIP Conference Proceedings, 2000.
• B. Rogers, S. Chhabra, M. Prvulovic and Y. Solihin, "Using Address Independent Seed Encryption and Bonsai Merkle Trees to Make Secure Processors OS- and Performance-Friendly”, MICRO 2007.