Flicker: Flicker: Minimal TCB Code Execution Minimal TCB Code - - PowerPoint PPT Presentation
Flicker: Flicker: Minimal TCB Code Execution Minimal TCB Code Execution Jonathan M. McCune Carnegie Mellon University March 25, 2008 Bryan Parno, Arvind Seshadri Adrian Perrig, Michael Reiter 1 Password Reuse People often use 1
1
Jonathan M. McCune
Carnegie Mellon University March 25, 2008 Bryan Parno, Arvind Seshadri Adrian Perrig, Michael Reiter
2
P A S S W O R D
3
web server
P A S S W O R D
My- hobby .com
www.myhobby.com is compromised!
4
– A compromised OS cannot learn the password – Only essential code can access password
– Can remotely verify this is so
– A viable alternative for passwords – Our techniques are more general
5
1. Existing approaches to system security 2. Remote attestation and verification 3. Static root of trust for measurement 4. Dynamic root of trust for measurement 5. Flicker: Minimal TCB Code Execution
– Example: IBM Integrity Measurement Arch. – Specifics of AMD SVM / Intel TXT
6
App1 App2 App3
Base (TCB)
Operating System Hardware
7
perform?
vulnerability?
App1 App2 App3 Operating System Hardware
8
– Simplicity – Adversary cannot inject any additional software
– Cannot update software (without exchanging ROM) – Adversary can still use control-flow attack – Entire system is in TCB, no isolation
– Impractical for current systems – Code updates are critical
A1 A2 A3 Operating System Hardware
9
– BIOS verifies signature on boot loader – Boot loader verifies signature on OS, ...
– Only approved software can be loaded
– Adversary only needs to compromise singe component – Entire system is in TCB, no isolation – Not all software is commercial
– Entire system is still part of TCB – Relatively weak security guarantee
A1 A2 A3 Operating System Hardware
10
inside different Virtual Machines
– Smaller TCB – Isolation between applications
– VMM is still large and part of TCB – Relatively complex, not suitable for average user
A1 A2 A3 OS OS OS VMM Hardware
11
1. Existing approaches to system security 2. Remote attestation and verification 3. Static root of trust for measurement 4. Dynamic root of trust for measurement 5. Minimal TCB Code Execution
– Example: IBM Integrity Measurement Arch. – Specifics of AMD SVM / Intel TXT
12
– Higher resilience to attacks – Remote verifier obtains no additional assurance
A1 A2 A3
Everything OK? Yes/No
Operating System Hardware
13
– Attestation tells verifier what code is executing on device – If intended code is executing on untrusted device, verifier can trust its operation
A1 A2 A3
What code is executing? Hash(Code)
Verifier Untrusted Device
Operating System Hardware
14
1. Existing approaches to system security 2. Remote attestation and verification 3. Static root of trust for measurement 4. Dynamic root of trust for measurement 5. Flicker: Minimal TCB Code Execution
– Example: IBM Integrity Measurement Arch. – Specifics of AMD SVM / Intel TXT
15
– Already included in many platforms – Cost per chip less than $10
that interact with TPM chip
– AMD SVM: SKINIT instruction – Intel TXT/LT: GETSEC[SENTER] instruction
16
standards for hardware-enabled trusted computing and security technologies.”
– Platform integrity measurements – Measurement attestation – Sealed storage
– Trusted boot (not secure boot) – Attestation
– Ensure absence of malware – Detect spyware, viruses, worms, …
17
Random Random Number Number Generator Generator Crypto Crypto RSA RSA Non-Volatile Non-Volatile Storage Storage (EK, AIK, SRK) (EK, AIK, SRK) Key Key Generation Generation Platform Platform Configuration Configuration Register (PCR) Register (PCR)
LPC bus LPC bus
Secure Secure Hash Hash SHA-1 SHA-1 I/O I/O
DIP Packaging or integrated into SuperIO
18
– PCRnew = SHA-1(PCRold||measurement)
– Attestation Identity Keys (AIKs) for signing PCRs – Attest to value of integrity measurements to remote party
– Protected storage + unlock state under a particular integrity measurement (data portability concern)
19
BIOS
Boot Loader OS Kernel
conf Module 2 Module 1
TPM
PCRs
BIOS
Boot Loader
Hardware Software
AIK-1
Apps
App 2 App 1
Apps
App 2 App 1
OS Kernel
conf
Module 2 Module 1
20
What code are you running?
1
} {
PCRs
Host platform Challenger
21
22
– Requires hundreds of integrity measurements just to boot – Every host is different
– What does a PCR mean in this context? – TCB includes entire system!
– Time-of-check-time-of-use (TOCTOU) problem – Cannot detect any dynamic attacks! – No guarantee of execution
A1 A2 A3 Operating System Hardware TPM
23
1. Existing approaches to system security 2. Remote attestation and verification 3. Static root of trust for measurement 4. Dynamic root of trust for measurement 5. Flicker: Minimal TCB Code Execution
– Example: IBM Integrity Measurement Arch. – Specifics of AMD SVM / Intel TXT
24
– Without a reboot! – Removes many things from TCB
– VMM can be measured (MVMM)
– Integrity of loaded code can be attested – Untrusted legacy OS can coexist with trusted software
software without breaking existing systems
25
– Formerly LaGrande Technology (LT)
– Late launch of a measured block of code – Hardware support for virtualization
– AMD provides measured environment only – Intel adds authenticated code capabilities
code
26
– DMA protection for memory – Intercept selected guest instructions / events – Much more…
– New instruction: SKINIT (Secure Kernel Init) – Requires appropriate platform support (e.g., TPM 1.2) – Allows verifiable startup of trusted software
27
– Memory region up to 64 KB
– Sets CPU state similar to INIT (soft reset) – Disables interrupts – Enables DMA protection for entire 64 KB SLB – Causes TPM to reset dynamic PCRs to 0 – Sends SLB contents to TPM – TPM hashes SLB contents and extends PCR 17 – Begins executing SLB
28
– Knows SKINIT was used – Knows software TCB includes only the SLB – Knows exactly what SLB was executed
– Knows any inputs to SLB – Knows any outputs from SLB – Knows exactly when SLB finished executing
29
execution
security properties
need to be trusted
A1 A2 A3 Operating System Hardware
30
– AMD Secure Virtual Machine (SVM) – Intel Trusted eXecution Technology (TXT)
31
1. Existing approaches to system security 2. Remote attestation and verification 3. Static root of trust for measurement 4. Dynamic root of trust for measurement 5. Flicker: Minimal TCB Code Execution
– Example: IBM Integrity Measurement Arch. – Specifics of AMD SVM / Intel TXT
32
Today, TCB for sensitive code S:
With Flicker, S’s TCB:
hardware
CPU, RAM TPM, Chipset
DMA Devices
(Network, Disk, USB, etc.)
App App 1
App
S
33
Shim
Software TCB < 250 LoC
34
maximum privileges
enabled device
– E.g., network cards, USB devices, hard drives
attacks
– E.g., power cycle the machine – Excludes physically monitoring/modifying CPU- to-RAM communication CPU, RAM TPM, Chipset DMA Devices
(Network, Disk, USB, etc.)
App App 1
Shim
S
35
– Pause current execution environment – Execute security-sensitive code with hardware- enforced isolation – Resume previous execution
– Preserve state securely across invocations – Attest only to code execution and protection – Establish secure communication with remote parties
36
TPM
PCRs: K-1
9 2 7
… CPU
App
Shim
S Module
RAM
App
Module
SKINIT Reset
Inputs Outputs Module
h H
Shim
S
37
TPM
PCRs: K-1
…
PCRs:
K-1 …
Shim
S
Inputs Outputs
38
PCRs:
K-1 …
Shim
S
Inputs Outputs
What code are you running?
Shim
S
Inputs Outputs
, K-1
, K-1
App
S
App 5 App 4 App 3 App 2 App 1
39 Shim
Shim
Shim
S
PCRs:
…
PCRs:
…
Time
Shim
S
Data
Shim
S
Shim
Shim
40
provides very limited functionality
do not require much
– E.g., key generation, encryption/decryption, FFT
particular security-sensitive operation
support code for security-sensitive code
41
Hardware
App 1 …
Shim
D
App n Run detector
OS
remote hosts
– E.g., only allow uncompromised laptops to connect to the corporate VPN
42
nonce Start
Gen {K, K-1}
K EncryptK(passwd) EncryptK(passwd) OK!
Shim
S
K
Shim
S K-1
Shim
S
K-1
Shim
S
EncryptK(passwd) passwd
43
– Private signing key isolated from entire system
– Verifiably perform a computational task on a remote computer – Ex: SETI@Home, Folding@Home, distcc
44
– Application state protection while OS runs
45
46
47
48
49