Who: Virgil Gligor CMU\
When: Friday, {{ page.date | date_to_long_string }}, 11:00-12:00\
Where: Room 8103\
Title: {{ page.title }}
Abstract:\
Suppose that a trustworthy program must be booted on a commodity system that may contain persistent malware. For example, a formally verified micro-kernel, micro-hypervisor, or a subsystem obtained from a trustworthy provider must be booted on a computer system that runs Windows, Linux, or Android applications. Establishing root of trust assures the user that either the system is in a malware-free state in which the trustworthy-program boot takes place or the presence of malware is discovered, with high probability. Obtaining such assurance is challenging because malware can survive in system state across repeated secure- and trusted-boot operations. These operations do not always have malware-unmediated access to device memories; e.g., memories of bring-your-own devices (e.g., keyboards, consoles, printers, routers), and sometimes even disk controllers. They certainly have no unmediated access to all non-volatile memories of interconnected components of a personal system; e.g., components of home systems, autos. To date, concrete assurance for root-of-trust establishment has not been obtained on commodity systems that scale to large configurations.
\
Establishing root of trust makes all persistent malware ephemeral and forces the adversary to repeat the malware-insertion attack, perhaps at some added cost. Nevertheless, some malware-controlled software can always be assumed to exist in commodity operating systems and applications. The inherent size and complexity of their operating systems and applications (aka the “giants”) render them vulnerable to successful adversary attacks. In contrast, small and simple software components with rather limited function and high-assurance layered security properties (aka the “wimps”) can be resistant to adversary attacks.
Maintaining root of trust assures a user that a commodity computer’s wimps are isolated from, and safely co-exist with, adversary-controlled giants. To survive, secure wimps must use services of, or compose with, insecure giants. This appears to be “paradoxical:” wimps can counter all adversary attacks but survive only if they use giants’ adversary-controlled services from which they have to defend themselves.
\
I this seminar, I will illustrate the challenges of root-of-trust establishment via “verifiable boot” operations that do not require secrets, TPMs, or adversary bounds. Then, I will present a method to define a wimp’s adversary accurately and completely using a structure found in cryptographic protocols. A consequence of such definitions is the ability to produce partial orders on adversary attacks. Finally, I will present secure wimp composition with giants, via two examples of experimental systems (i.e., on-demand isolated I/O channels and a trusted display service) designed and implemented at CMU CyLab.
Biographical Note Virgil D. Gligor received his B.Sc., M.Sc., and Ph.D. degrees from the University of California at Berkeley. He taught at the University of Maryland between 1976 and 2007, and is currently a Professor of ECE at Carnegie Mellon University. Between 2007 and 2015 he was the co-Director of CyLab. Over the past forty years, his research interests ranged from access control mechanisms, penetration analysis, and denial-of-service protection, to cryptographic protocols and applied cryptography. Gligor was an editorial board member of several ACM and IEEE journals and the Editor in Chief of the IEEE Transactions on Dependable and Secure Computing. He received the 2006 National Information Systems Security Award jointly given by NIST and NSA, the 2011 Outstanding Innovation Award of the ACM SIG on Security Audit and Control, and the 2013 Technical Achievement Award of the IEEE Computer Society.
{: .t60 } {% include list-posts tag=‘csstalk’%}