Trading-off security and performance in barrier slicing for remote software entrusting

Abstract

Network applications often require that a trust relationship is established between a trusted host (e.g., the server) and an untrusted host (e.g., the client). The remote entrusting problem is the problem of ensuring the trusted host that whenever a request from an untrusted host is served, the requester is in a genuine state, unaffected by malicious modifications or attacks.Barrier slicing helps solve the remote entrusting problem. The computation of the sensitive client state is sliced and moved to the server, where it is not possible to tamper with it. However, this solution might involve unacceptable computation and communication costs for the server, especially when the slice to be moved is large. In this paper, we investigate the trade-off between security loss and performance overhead associated with moving only a portion of the barrier slice to the server and we show that this trade-off can be reduced to a multi-objective optimization problem. We describe how to make decisions in practice with reference to a case study, for which we show how to choose among the alternative options.

Reactive Attestation

“…This transformation was initially designed as a way to protect programs from malicious tampering [7,8]. In fact, if sensitive portions or critical functionalities are moved to a remote server, they can run securely and without being tampered with by the attacker.…”

“…The identification of the most appropriate part to split can be automated, for example as suggested by Ceccato et al [8]. They relied on static analysis to identify and minimise control and data dependencies that would be impacted by the transformation.…”

“…Although automation can be implemented according to algorithm available in the literature [8], the current implementation requires to manually annotate slicing barriers and criteria. Once barriers and criteria are available, the computation of the slice and all the program transformation steps are fully automated.…”

“…The concept of barrier slicing was also used by Ceccato et al [7,8] to design a protection technique against malicious tampering, with the idea of using barrier slicing to ensure that security critical portions of client computation are executed on the secure server. In our work, barrier slicing is applied to required although less critical functionalities, to turn the application server dependent and to perform the reaction is case of tampering detection.…”

Remote software protection by orthogonal client replacement

“…This solution introduces both a communication overhead and a computation overhead on the server. The trade-off between the security and cost of this protection scheme has been studied in [5]. It is worth mentioning that the idea of splitting an application between client and server has been already used by Zhang and Gupta in order to prevent software piracy [19].…”