A design and verification methodology for secure isolated regions

Abstract

Hardware support for isolated execution (such as Intel SGX) enables development of applications that keep their code and data confidential even while running on a hostile or compromised host. However, automatically verifying that such applications satisfy confidentiality remains challenging. We present a methodology for designing such applications in a way that enables certifying their confidentiality. Our methodology consists of forcing the application to communicate with the external world through a narrow interface, compiling it with runtime checks that aid verification, and linking it with a small runtime library that implements the interface. The runtime library includes core services such as secure communication channels and memory management. We formalize this restriction on the application as Information Release Confinement (IRC), and we show that it allows us to decompose the task of proving confidentiality into (a) one-time, human-assisted functional verification of the runtime to ensure that it does not leak secrets, (b) automatic verification of the application's machine code to ensure that it satisfies IRC and does not directly read or corrupt the runtime's internal state. We present /CONFIDENTIAL: a verifier for IRC that is modular, automatic, and keeps our compiler out of the trusted computing base. Our evaluation suggests that the methodology scales to real-world applications.

Compiling Sandboxes: Formally Verified Software Fault Isolation

“…Since Wahbe et al [35] proposed their initial technique for SFI, there has been a number of proposals for efficiently confining untrusted software to a memory sandbox (see [23,24,31,32,34,37,39]). One of the most prominent is Google's Native Client (NaCl) [37], which provides an infrastructure for executing untrusted native code in a web browser.…”

Verification of a Practical Hardware Security Architecture Through Static Information Flow Analysis

“…Sinha et al [30,29] verify the security of programs which use SGX enclaves to ensure that hardware security features are used correctly. Gollamudi et al [13] use information flow in software to partition programs into TrustZone worlds or SGX enclaves.…”

Symbolic Models for Isolated Execution Environments

“…Various works consider properties of assembly code running in IEEs. Notably in [12] Sinha et al provide a tool and design methodology ensuring confidentiality of private values and code contained in IEEs. In [13] Patrignani and Clarke give an abstraction of isolation mechanisms at the source code level.…”