Secure Compilation to Protected Module Architectures

Abstract

A fully abstract compiler prevents security features of the source language from being bypassed by an attacker operating at the target language level. Unfortunately, developing fully abstract compilers is very complex, and it is even more so when the target language is an untyped assembly language. To provide a fully abstract compiler that targets untyped assembly, it has been suggested to extend the target language with a protected module architecture—an assembly-level isolation mechanism which can be found in next-generation processors. This article provides a fully abstract compilation scheme whose source language is an object-oriented, high-level language and whose target language is such an extended assembly language. The source language enjoys features such as dynamic memory allocation and exceptions. Secure compilation of first-order method references, cross-package inheritance, and inner classes is also presented. Moreover, this article contains the formal proof of full abstraction of the compilation scheme. Measurements of the overhead introduced by the compilation scheme indicate that it is negligible.

Salus: Kernel Support for Secure Process Compartments

“…Salus' memory isolation mechanism provides strong guarantees that sensitive data in the private section can only be accessed by code in the public section [27][28][29][30]. Reconsidering our certificate signing service as an example (see Figure 1), we can prove that the signing key will never leave its compartment.…”

“…However, recent research [27][28][29][30] has shown that memory protection mechanisms such as those offered by Salus, are able to provide full source code abstraction. This means that, even when other compartments have been successfully exploited, an attackers' capabilities are limited to interacting with the memory-safe compartment through its public interface.…”

“…More recently, specially tailored hardware support has been proposed in academia [11][12][13] and industry [14][15][16]. While these research prototypes offer provable security to the sensitive data that they protect [27][28][29][30], they do not attempt to reduce the impact of a vulnerability elsewhere in the code by executing modules with the least amount of privileges possible [20]. An attacker who successfully gains control over the platform is still able to interact with other protected modules unrestrictedly.…”

Formalizing a Secure Foreign Function Interface

“…Preserving full abstraction when faced with a machine level attacker has been achieved by employing memory isolation mechanisms that prevent the attacker from directly accessing the memory of the program being secured [11]. To that end the program state P is split into two sub-states: the attacker state A and the secured program state M that incorporates the MiniML program.…”

Idea: Towards an Inverted Cloud

“…Hence, even when the system is infested with malware, secrecy and integrity of protected modules remain guaranteed. Recent work by Agten et al [1,2] and Patrignani et al [16,17] proves that highlevel software properties can also be guaranteed at low-level by relying on PMA's memory protection and inserting proper checks at compile time.…”