Verification of a Generative Separation Kernel

Haque, Inzemamul; D’Souza, Deepak; Habeeb, P; Kundu, Arnab; Babu, Ganesh

doi:10.1007/978-3-030-59152-6_17

Cited by 2 publications

(3 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In order to protect from remotely exploitable vulnerabilities, we suggest to use formal verification wherever possible. There exists a vast body in the literature that is applicable to the implementations we discuss below, like smart cards ( [2,5]), cryptographic implementations in the IoT world [45], FPGAs and ASICs [9,20] or microkernels [26,31]. Due to the very low complexity of the cryptographic core, formal verification is applicable in practice for our modules.…”

Section: Implementations Of Remotely Unhackable Hardware Modulesmentioning

confidence: 99%

“…To this end, there are two main approaches. The first considers a hypervisor [26,31] that implements each component in a dedicated virtual machine. Assuming that i) the hypervisor is secure and provides isolation between the individual VMs and the host and ii) the components are implemented correctly, the resulting system can be considered a secure implementation of our construction.…”

Section: Virtualization and Teesmentioning

confidence: 99%

“…An example is the NetHSM by Nitrokey [38], whose whole software is written in the memory-safe language OCaml. As OS, MirageOS with the formally verified microkernel Muen [26] is used. The security token Solo 2 [50] has an extensible open-source firmware, Trussed [51], written in Rust and can similarly be adjusted.…”

Section: Data Diodes and Air-gap Switchesmentioning

confidence: 99%

See 2 more Smart Citations

Fortified Multi-Party Computation: Taking Advantage of Simple Secure Hardware Modules

Broadnax¹,

Koch

Mechler

et al. 2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

In practice, there are numerous settings where mutually distrusting parties need to perform distributed computations on their private inputs. For instance, participants in a first-price sealed-bid online auction do not want their bids to be disclosed. This problem can be addressed using secure multi-party computation (MPC), where parties can evaluate a publicly known function on their private inputs by executing a specific protocol that only reveals the correct output, but nothing else about the private inputs. Such distributed computations performed over the Internet are susceptible to remote hacks that may take place during the computation. As a consequence, sensitive data such as private bids may leak. All existing MPC protocols do not provide any protection against the consequences of such remote hacks. We present the first MPC protocols that protect the remotely hacked parties’ inputs and outputs from leaking. More specifically, unless the remote hack takes place before the party received its input or all parties are corrupted, a hacker is unable to learn the parties’ inputs and outputs, and is also unable to modify them. We achieve these strong (privacy) guarantees by utilizing the fact that in practice parties may not be susceptible to remote attacks at every point in time, but only while they are online, i.e. able to receive messages. To this end, we model communication via explicit channels. In particular, we introduce channels with an airgap switch (disconnect-able by the party in control of the switch), and unidirectional data diodes. These channels and their isolation properties, together with very few, similarly simple and plausibly remotely unhackable hardware modules serve as the main ingredient for attaining such strong security guarantees. In order to formalize these strong guarantees, we propose the UC with Fortified Security (UC#) framework, a variant of the Universal Composability (UC) framework.

show abstract

Section: Implementations Of Remotely Unhackable Hardware Modulesmentioning

confidence: 99%

Section: Virtualization and Teesmentioning

confidence: 99%

See 1 more Smart Citation

Fortified Multi-Party Computation: Taking Advantage of Simple Secure Hardware Modules

Broadnax¹,

Koch

Mechler

et al. 2021

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

show abstract

A Verification Methodology for the Arm® Confidential Computing Architecture: From a Secure Specification to Safe Implementations

Fox

Stockwell

Xiong

et al. 2023

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

We present Arm's efforts in verifying the specification and prototype reference implementation of the Realm Management Monitor (RMM), an essential firmware component of Arm Confidential Computing Architecture (Arm CCA), the recently-announced Confidential Computing technologies incorporated in the Armv9-A architecture. Arm CCA introduced the Realm Management Extension (RME), an architectural extension for Armv9-A, and a technology that will eventually be deployed in hundreds of millions of devices. Given the security-critical nature of the RMM, and its taxing threat model, we use a combination of interactive theorem proving, model checking, and concurrency-aware testing to validate and verify security and safety properties of both the specification and a prototype implementation of the RMM. Crucially, our verification efforts were, and are still being, developed and refined contemporaneously with active development of both specification and implementation, and have been adopted by Arm's product teams. We describe our major achievements, realized through the application of formal techniques, as well as challenges that remain for future work. We believe that the work reported in this paper is the most thorough application of formal techniques to the design and implementation of any current commercially-viable Confidential Computing implementation, setting a new high-water mark for work in this area.

show abstract

Verification of a Generative Separation Kernel

Cited by 2 publications

References 21 publications

Fortified Multi-Party Computation: Taking Advantage of Simple Secure Hardware Modules

Fortified Multi-Party Computation: Taking Advantage of Simple Secure Hardware Modules

A Verification Methodology for the Arm® Confidential Computing Architecture: From a Secure Specification to Safe Implementations

Contact Info

Product

Resources

About