InkTag: Secure Applications on an Untrusted Operating System Paper - - PowerPoint PPT Presentation
InkTag: Secure Applications on an Untrusted Operating System Paper from The University of Texas at Austin by: Owen S. Hofmann, Kim Sangmann, Alan M. Dunn, Michael Z. Lee, and Emmett Witchel Presented by: Kyle May and Carson Boden Outline
Paper from The University of Texas at Austin by: Owen S. Hofmann, Kim Sangmann, Alan M. Dunn, Michael Z. Lee, and Emmett Witchel Presented by: Kyle May and Carson Boden
Motivation Prior Work High-Level Overview Memory Isolation Paraverification Access Control Storage and Consistency Testing and Evaluation Conclusion
2
The operating system was once the root of trust Attacks against the OS render the system completely vulnerable Goal: For applications to remain safe, even on a compromised OS
3
Motivation Prior Work High-Level Overview Memory Isolation Paraverification Access Control Storage and Consistency Testing and Evaluation Conclusion
4
High Assurance Processes (HAPs) prohibited from using any OS resources Programs could run, but were useless without OS intervention InkTag focuses on allowing HAPs to interact with the OS safely
5
Motivation Prior Work High-Level Overview Memory Isolation Paraverification Access Control Storage and Consistency Testing and Evaluation Conclusion
6
Resides between the OS and Hardware level Introduces paraverification, requiring the OS to verify its own behavior Allows applications to define access policies Provides crash consistency between secure metadata
From Hofmann et. al
7
Motivation Prior Work High-Level Overview Memory Isolation Paraverification Access Control Storage and Consistency Testing and Evaluation Conclusion
8
HAPs have separate trusted and OS contexts Files (Objects) are identified by 64-bit Object Identified (OID) Objects composed of secure pages (S-pages), encrypted and hashed
9
Extended Page Tables (EPTs) are managed by the hypervisor Cleartext allows HAPs to freely access their data When OS tries to access cleartext S-page, hypervisor intervenes
From Hofmann et. al
10
Motivation Prior Work High-Level Overview Memory Isolation Paraverification Access Control Storage and Consistency Testing and Evaluation Conclusion
11
InkTag intercepts low-level page table updates and determine effects State maintained to quickly determine effects of changes HAPs provide OS a token to describe memory mapping
12
Motivation Prior Work High-Level Overview Memory Isolation Paraverification Access Control Storage and Consistency Testing and Evaluation Conclusion
13
Useful access control mechanisms allow for: Easy implementation in the hypervisor The use of familiar primitives Creation of new policies in a decentralized way
14
Each HAP has a string (.user.kyle) of attributes Events like fork() and exec() allow for inheritance Each object (OID) has a list of attributes with different permissions
15
Normally, all users would trust the single login binary In a decentralized system, all users can trust their own login binaries Enabled by the passing of attributes between the system admin and the user
16
Motivation Prior Work High-Level Overview Memory Isolation Paraverification Access Control Storage and Consistency Testing and Evaluation Conclusion
17
Metadata is required for the maintenance of the S-pages Metadata is stored near the data it describes Paraverification synchronizes OS actions
From Hofmann et. al
18
Motivation Prior Work High-Level Overview Memory Isolation Paraverification Access Control Storage and Consistency Testing and Evaluation Conclusion
19
Prototype built from KVM hypervisor Ran on actual h/w Benchmarked with LMBench, SPEC CPU2006, Apache, and DokuWiki
From Hofmann et. al
20
From Hofmann et. al
21
From Hofmann et. al
22
Motivation Prior Work High-Level Overview Memory Isolation Paraverification Access Control Storage and Consistency Testing and Evaluation Conclusion
23
Hypervisor offloads work to the OS Low complexity and overhead means codebase is easy to maintain InkTag is highly efficient, but added security is relatively unknown
24
Does this solve the problem? Are devices considered more secure with a hypervisor? What type of vulnerabilities does InkTag introduce? Is the result of the InkTag implementation worthwhile? Are the performance and complexity overheads worth the variable increase in security?
25
https://dl.acm.org/citation.cfm?id=2451146 www.cs.kent.edu/~rothstei/...13/.../AnwarAlsulaimanSecureAppsonUntrustedOS.pptx
26