this is joint work with my colleagues in
Stony Brook Sebastian man Johnson
disjunction and my advisors don't look
so first of all what other execution
units that we are mentioning that we're
talking about here and why do we need a
more fine-grained one so there are on to
it execution unit assists in the current
oasis so namely the processes and
threats and the distinction between then
is that processes have separate address
spaces while Stuart's they'd only share
one if they belong to the same as their
group and this model has been used for
decades it runs very well but it doesn't
match with the modern app development
paradigm where multiple components from
different parties are get put together
into one single application and this
model cannot defend against a class of
attacks that we try to address in our
work so this attacks is turned by us in
process memory abuses that here's the
definition basically there are if there
are malicious or compromised components
they try to steal data or sq code of
other components running in the same
process and we call it in process memory
of abuses let me give you two examples
the first one is about stealing secret
data remember the public back from two
years ago if the attacker can exploit
the vulnerable open seas our library
then he is able to steal the sensitive
data from the web server process such as
private keys or login passwords and the
second example about executing private
code so in iOS applications there are
those privates api's gets loaded into
the user address space of the use of the
applications and this opens up a window
for the attackers to find out those AP
ice and then invoke them during run time
to do harm to the system and certainly
on the threat of impress abuse has been
there since the day one of this model of
virtual memory so there are certain
techniques out there that could be the
potential medications of this problem
but they are only doing it either
partially or paying too much prices so
the first line of work belong to the
ss level isolation so basically a put
different components into different
address spaces and then use a different
processes surround them you can find
this approach being adopted to open
stage and chrome but the problem with is
the ibc it's very expensive but this
approach heavily rely on IPC to to data
exchange or synchronization successor
also the adoption adversities are
relatively high because you're basically
are splitting monotonic applications
into multiple components let alone if
you can do this or not even assume that
you can do it it's still kind of
difficult because you now have to deal
with those concurrency issues which is
very error-prone and the second line of
work belongs to the software fault
isolation one example is Google's native
clients so no step because of the stura
model of native clients on it can only
adjust a subset of being processed abuse
problems because it requires to
instrument the untrusted code which
means that it's ineffective only
dynamically generated or the external
code and the last line of work of the
techniques belongs to the highway
assisted techniques such as in-house sgx
or arms chest zone on those are in terms
of security this techniques of doing
well but in terms of usability on so for
example in Intel SGX it's being overly
restrictive for for example when the co
running anxiety securing environments of
the sgx the cocaine not even make system
costs also in armchairs own you bring up
this on semantic gap that you need to
fill up with so it's kind of difficult
sometimes to use them with other beings
that we want to propose Fred you can
feel stressed as arbitrary scope
arbitrary scope segments of the stura
executions on the left hand side on this
figure those red lines scoped by the
dash for tangos those other threats and
what's special about red is that each
one of them get to have a private memory
pool allocated from the same virtual
address space and this private memory
pool can only be accessed by the
corresponding spirit and we turn them
out as pool also we have a
out of AP is and that are backed by our
os-level support and for the developers
to use our system which I was or in the
latest light so because we need to
operate an OS level we assume a trustee
OS but there are unjustly components in
the victim process which means that
other components in that process are
subjected to the attacks of this
untrusted component so now allow me use
the high level example to better
illustrate the idea of shred using the
case of doing password authentication on
web server so the scenario is that the
client will send the password to the web
server and the web server will to
compute a hash of this password and do
the authentication etc and this is the
first row address space of a web server
process so you can see the relative the
yellow bars or where the plaintext
password okay doing so in case of a in
process memory abuse attacks there is a
malicious component in this case it's a
malicious library and if it wants to
steal the sensitive data located in the
industry users in this area that is very
difficult to defend against that but
with shred what we can do is we can put
those sensitive data inside a spool and
only the are corresponding
authentication shredder will be able to
access them so in case of malicious
components again this is attempt to
steal the secret data will be blocked by
us so now i want to show you to set up
for AP is the first day is called on
recreation api's namely to enter and
axis so the idea is that whatever code
running in between the invocations of
this to api arco running inside fred and
as you can see three enter takes one
argument called put descriptor to
indicate which as put it for its bounty
to and we have a second set of api
scores po allocation api's they function
similarly to the julie bc malloc and
free so the idea is that you call them
inside where to allocate sorry memory
inside espoo now allow me to show you
the co example like how to use those for
AP is again using the same cases of
doing password authentication on web
server this is the coolest in from light
which is lightweight web servers so
basically when the web server see there
is a coming authentication requests and
it will just call our enter to make this
password pool available and then you can
cause SDS in its which is the wrapper of
despereaux location API which I will
show you in the next slides and then you
can allocate memory inside espoo then
the web server can store the sensitive
data inside as food and cultural access
to a lot distance put down so that no
one else's can access it later and on
the left-hand side are the RS
publication wrappers on and on the right
hand side which is the code for the
authentication shred so very intuitive
you just culture enter again to make
this as per available then you can do
the computation to access these memories
like just like they are the normal
memory and then after you down you
called SDS free to free you can free
this jungle memory for later used by
other components and Daniel cultural
axis to finish this for execution okay
so now let me show you the overview of
our system basically we have two major
components as driver and as compiler so
as driver is the OS module that up will
deal with those runtime events such as
our entry axis or as per allocation
de-allocation etc and on the right hand
side at the runtime view of our system
so what's not mentioning here is that we
actually allow multiple threats to share
the same as pool because imagine a
scenario that there is a encryption and
decryption shreds they might want to
share they want to share this and a set
of crypto keys and we also have a way to
prevent the attacker from abusing this
feature which I was reviewing the latest
lights so now let's dive into the s
driver I want to show you how we build
the concept of s pool basically we
utilize the our memories of my mechanism
as our building block but before I move
on I also want to remind you that intel
has a very similar mechanism called
memory protection keys in the upcoming
cpus so the design that i talked about
here can be very broadly applied to the
india as well but for the sake of this
talk let's just
focus on arm so on the right hand side
of the page tables a structure of
architecture and as you can see in the
first layer page table you can basically
tag them with different domains in this
case we have domain 1 and domain 14 and
also in the system there are those
domain access control registers so they
function just like their names by
assigning value into incident you can
basically control the accessibility of
different domains on the corresponding
quarters registers are banked just for
your information and in this case we
have domain 14 is accessible and domain
one is not so based on el momento man is
very intuitive to build a concept of as
Pope but still we have several
challenges to deal with the first one is
that the granularity of the assessing
subject he only be checked at sea level
and corresponding core about way we want
something more fine-grained so we create
a notion of threat such so that the
assessing subject can be recognized and
as a threat level and then we can use s
driver to manage them and the second
limitation is that there are only
existing demands available on in the
inner systems so we cannot fully
allocate a new domain whenever a new as
food gets allocated because it is does
not scale so the solution to that is
that we statically bind an accessible
domain to each CPU and then we reduce
that domain for multiple high schools if
they are accessed from the same CPU but
not at the same time let me use a
high-level example to show you how this
works this Q face representative dual
core system and the two eyebrows
represent the two domain access control
registers as you can see in their
entries of them if it's great means on
only corresponding poor this domain is
not accessible but if its colorful means
the other way so the two eyes
represented two course and mouth
represent a virtual address space of a
process that is using our system and
there are two the 2 t's represented to a
spruce that belongs to two different on
friends so if there's a number one
running the yellow corn now it wants to
access its as poo number
what we do is we assign the domain of
this as put to the yellow domain so that
the district and access it's as pool but
no houses can and if at the same time
another thread running on core numbers
who wants to access it cesspool number
two we do the same thing except that we
change the domain of that s put to the
orange Edo man so the results that both
of them can access their own CP at their
own as posed but not each other's
because this is prevented by the
dimensions control registers set up up
there as you can see and when they're
down the code for exits so so we
assigned domain of the aspects back to
the radiomen again so to sum up as
driver will act as proven true exit or
when it's congress which our the code
running in stylish red or the reason is
synchronized events such as signal
handling etc and you will unlock the as
pool for those opposite effect so we
want to optimize our system by moving
the domain adjusting off the critical
path that will be because adjusting that
domain is relatively cumbersome because
you a need to do page table working and
then be you have to invalidate the
corresponding tlb entries to make this
change take effect so how we do that is
remember there are two knobs that could
control the accessibility of as post the
first one is the domain of the page
table entry yeah the second one is the
value of those registry entries so we
are use the second way to move the
domain Justin our critical paths because
changing the register value is much much
faster it only takes one instruction as
highlighted there and he takes it as
almost instantly the only problem is
that on now even the legitimate domain
assets could trigger the domain thought
so we develop the domain thoughts handle
her to lazily handle the domain faults
that triggered by different events such
as if it was an attack then we will
abort a program or if it's a legitimate
domain access then we will help the
program recover from that domain thought
so other than those things as driver
will also provide certain runtime events
the first one is the secure stacks so
the idea is that each etre has a secure
stack allocated from
its own as pool and we switch this
directive industry enter and and other
defense because we don't want the
sensitive data computed by a thread to
be accessed by other components in the
process and also there are certain
system interfaces the S driver needs to
take care of such as if the attacker
wants pictures the code running inside
shred or try to directly read a
sensitive value from the physical memory
or from the i/o channels s driver will
block those accordingly and here's an
attic components in our system as
compiler as compiler will do the
following things such as a verified
kereta API usage and B remember this
show as proof feature that I mentioned
previously so on how has compiled do
this is that by associating each thread
with its as post at compile time and
then each store the information in the
generated binary so that this
information can be registered to the ask
driver during the low time of the
program and also as driver will do
certain flow analysis and
instrumentation to for example hardening
the control flow of the inks record or
do some data flow checking to prevent
the infrared code from accidentally
propagates the sensitive data from the
Espiritu the unprotected memory for more
information please refer to our paper on
the reason of time I needs to jump to
the evaluation so we prototype our
system on top of Raspberry Pi to
multiple with the cortex a7 processor
which it has only one gigabyte memory
and we adopt straight into this 50
venture software's will choose them
because intuitively each one of them has
some sensitive data to protest for
example likely the login password or the
openssl the private keys and for the
record in our evaluation will only
protect one kind of sensitive data for
each one of the softwares because we
another developers of them it's kind of
difficult if not impossible for us to
identify all the possible sensitive data
that they have and regarding the
adoption efforts Oh average you only
introduce 20 at 21 line of codes
changing to them and you only took us 32
minutes to adopt right into them
because the adoption process is very
straightforward but not once you know
what beta okay we want to protect just
find the code that Isis stem and wrap
them with the corresponding for AP ice
so minimum coach ange and regarding the
performance we observe less than five
percent slow down on some of them
because of the system cause some of them
because the instrumentation code added
by the S compiler and on average rate we
sought less than a percent memory
overhead and here's another evaluation
results we want to compare those four
API switch the corresponding system
costs so I'll go into this diskette PID
which is one of the lightest sis course
in Linux and we compared to recreation
api's with a clone Teal'c alone is the
one that create a threat so for entry
and relaxes as you can see procreation
API to run slightly faster than Colonia
almost twice the time of get PID and
also we compared as poor allocation API
serves em map here as application runs
slightly slower but this is actually
expected because there are the wrappers
of em map so to conclude our goal is to
help developers to protect the sensitive
code or data from in process abuse and
to achieve that goal with pros threads
with private memory or threat of an
grant you can fill them as flexible
scope segments of their executions and
rota efficient and comparable because we
based on a menu dome and check and we
don't introduce multiple page tables we
don't have nested pagelings now have
instrumentations and lastly know how our
modifications so you can just grab our
driver and by are machined and use our
system and also the last but not least
as robust because we not just prevent
the attacker from attacking threat from
the code outside even if the type of
fine manages to find vulnerabilities for
coding infrared we also make sure that
on its the chances the attacker put this
attack offer will be negligible so that
concludes my talk I want I'm happy to
take questions
hey thanks a lot so this may be in the
part where you said I don't have time to
talk about this so read the paper but
how do you keep the light the evil
library from just calling shred enter
with some other oks pool and reading the
data directly yes thank you for the
question on so this is actually this
feature called as push rearing and I
also mentioned in the talk that how the
S compiler prevent this attack from
happening is that Ella compile time are
as compiler will try to associate each
correct enter coincides with the SP SP
descriptor and store that information at
the generator binary additional elf
section and this information will be
registered to the edge driver at the
program load time so if there's a
malicious library try to call us or
enter with other tres a spool descriptor
it will be like rejected by desh driver
so okay thank you Brian Ford EPFL nice
work I like especially like the
attention to the kind of IPI simplicity
and stuff I am a little concerned you
didn't describe the threat model very
too much I'm concerned it you know if
these the attack code can kind of live
anywhere and do you know a lot of other
things in the library why wouldn't the
attack code just try to try to say cause
your replace the the Shred based
password check password hash checking
code with its own version that doesn't
use threat shreds you know for aggregate
you know by fiddling with a function
pointer or a some dll or you know a dll
loading state or something to to just
kind of redirect the whole you know
password checking module to something
that the the malicious library controls
so yes this is this attack is that salad
and our current implementation we
require
the source codes of the like the
libraries or those things and during our
compile time we will like do the program
analysis for the whole other modules
together and I'm not sure if I
understand that we can discuss the
details online it's just I kind of
unclear what what the separation between
the trusted part of the code and
untrusted is I'd like to but yeah there
that offline thank you no good stuff
like you I can fix that so what you need
to do is you need to associate what code
is with a shred well so that you can't
control flow inject out of a shred to
the library alternatively just use Intel
SGX and encrypt your coat and your data
if you can stand the overheads it'll
give you the same ability today yeah as
checks is very secure in that sense and
but the problem is that you know so in
the unclaimed the security environment
sgx the code cannot make system cause so
it's kind of for some cases states kind
of difficult to use them for example
there are some papers before that has to
throwing the whole OS in the unclaimed
to make the applications work so in that
kind of scenario if you are willing to
assist and the security guarantee that
we provide then I think our solution is
actually easier to use so in either case
so you've got to draw lines around stuff
and you're just doing thread calls sgx
is got to do more like the chrome style
sandboxing but thank you very much okay
thanks I Paul makowsky from North
industries thanks for the talk so my
question is regarding memory protection
keys so you talked a lot about armed
protection domains and that would
require you know Colonel involvement to
change the protection domains but for
the memory protection keys my
understanding is you can just issue new
instructions in user space that would
write to those keys that would hold
whether or not you can read or write two
different domains so I guess my question
is do you does your compiler and
imitation ban instructions would you
have to do something like nakal where
you have a verification pass to make
sure you don't have off cut instructions
that represent those instructions okay
so yeah what you said is valid and I
think you also kind of answer the
questions they erased so yes in the
memory toast protesting keys the user
level code can like change the value of
their registers but what we can do is
that I mean fundamentally the designs
will still be mostly the same is that
that we could use compiler techniques to
like sanitize the code to make sure that
there is no like gadgets to change their
verification passes well then is that
correct okay