Building verifiable trusted path on commodity x86 computers

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2012, Pages 616-630

  Zhou, Zongwei ^a   Gligor, Virgil D ^a   Newsome, James ^a   McCune, Jonathan M ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

Device Input Output; Hypervisor; Isolation; Trusted Path; Trustworthy Computing

Indexed keywords

HAND HELD COMPUTERS; TRUSTED COMPUTING;

'CURRENT; COMMODITY SYSTEMS; DEVICE INPUT/OUTPUT; HYPERVISORS; INPUT-OUTPUT; INPUT/OUTPUT DEVICES; ISOLATION; SIMPLE++; TRUSTED PATH; USER INPUT;

DATA TRANSFER;

EID: 84878350874     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2012.42     Document Type: Conference Paper

References (65)

1. T. Alves and D. Felton. TrustZone : Integrated Hardware and Software Security. ARM white paper, 2004.
2. AMD. AMD I/O virtualization technology (IOMMU) specification. AMD Pub. no. 34434 rev. 1.26, 2009.
3. AMD. AMD 64 Architecture Programmer's Manual: Volume 2: System Programming. Pub. no. 24593 rev. 3.20, 2011.
4. AMD and HP. PCI Express Access Control Services (ACS): PCI-SIG Engineering Change Notice, 2006.
5. C. R. Attanasio, P. W. Markstein, and R. J. Phillips. Penetrating an operating system: a study of VM/370 integrity. IBM System Journal, 15(1):102-116, 1976.
6. A. M. Azab, P. Ning, and X. Zhang. SICE: a hardware-level strongly isolated computing environment for x86 multi-core platforms. In Proc. ACM Conference on Computer and Communications Security, 2011.
7. BAE Systems Information Technology LLC. Security Target, Version 1.11 for XTS-400, Version 6, 2004.
8. P. Barham, B. Dragovic, K. Fraser, S. Hand, T. Harris, A. Ho, R. Neugebauer, I. Pratt, and A. Warfield. Xen and the art of virtualization. In Proc. ACM Symposium on Operating Systems Principles, 2003.
9. K. Borders and A. Prakash. Securing network input via a trusted input proxy. In Proc. USENIX Workshop on Hot Topics in Security, 2007.
10. R. Budruk, D. Anderson, and E. Solari. PCI Express System Architecture. Addison-Wesley Professional, 2003.
11. Y. Cheng, X. Ding, and R. H. Deng. DriverGuard: A fine-grained protection on I/O flows. In Proc. European Symposium on Research in Computer Security, 2011.
12. D. Clark. An Input/Output Architecture for Virtual Memory Computer Systems. PhD thesis, MIT, 1974.
13. D. D. Clark and M. S. Blumenthal. The end-to-end argument and application design: the role of trust. Federal Communications Law Journal, 63(2):357-390, 2011.
14. P. Colp, M. Nanavati, J. Zhu, W. Aiello, G. Coker, T. Deegan, P. Loscocco, and A. Warfield. Breaking up is hard to do: Security and functionality in a commodity hypervisor. In Proc. ACM Symposium on Operating Systems Principles, 2011.
15. Common Criteria for Information Technology Security Evaluation (CC). Common methodology for information technology security evaluation. Version 3.1 CCMB-2009-07-004, 2009.
16. Department of Defense. Trusted computer system evaluation criteria (orange book). DoD 5200.28-STD, 1985.
17. A. Dua, N. Bulusu, W.-C. Feng, and W. Hu. Towards trustworthy participatory sensing. In Proc. USENIX Conference on Hot Topics in Security, 2009.
18. D. R. Engler, M. F. Kaashoek, and J. O'Toole, Jr. Exokernel: An operating system architecture for application-level resource management. In Proc. ACM Symposium on Operating Systems Principles, 1995.
19. J. Epstein, C. Inc, J. McHugh, H. Orman, R. Pascale, A. Marmor-Squires, B. Danner, C. R. Martin, M. Branstad, G. Benson, and D. Rothnie. A high assurance window system prototype. Journal of Computer Security, 2(2):159-190, 1993.
20. N. Falliere, L. O. Murchu, and E. Chien. W32.stuxnet dossier. Symantec, version 1.3, 2011.
21. N. Feske and C. Helmuth. A nitpicker's guide to a minimal-complexity secure GUI. In Proc. Annual Computer Security Applications Conference, 2005.
22. A. Filyanov, J. M. McCune, A.-R. Sadeghi, and M. Winandy. Uni-directional trusted path: Transaction confirmation on just one device. In Proc. IEEE/IFIP Conference on Dependable Systems and Networks, 2011.
23. S. Fleming. Accessing PCI Express configuration registers using Intel chipsets. Intel White Paper no. 321090, 2008.
24. J. Franklin, S. Chaki, A. Datta, J. M. McCune, and A. Vasudevan. Parametric verification of address space separation. In Proc. Conference on Principles of Security and Trust, 2012.
25. J. Franklin, S. Chaki, A. Datta, and A. Seshadri. Scalable parametric verification of secure systems: How to verify reference monitors without worrying about data structure size. In Proc. IEEE Symposium on Security and Privacy, 2010.
26. V. Ganapathy, M. J. Renzelmann, A. Balakrishnan, M. M. Swift, and S. Jha. The design and implementation of microdrivers. In Proc. International Conference on Architectural Support for Programming Languages and Operating Systems, 2008.
27. P. Gilbert, L. P. Cox, J. Jung, and D.Wetherall. Toward trustworthy mobile sensing. In Proc. Workshop on Mobile Computing Systems and Applications, 2010.
28. V. D. Gligor, C. S. Chandersekaran, R. S. Chapman, L. J. Dotterer, M. S. Hecht, W.-D. Jiang, A. Johri, G. L. Luckenbaugh, and N. Vasudevan. Design and implementation of secure Xenix. IEEE Transactions on Software Engineering, 13(2):208-221, 1986.
29. R. Gummadi, H. Balakrishnan, P. Maniatis, and S. Ratnasamy. Not-a-bot: Improving service availability in the face of botnet attacks. In Proc. USENIX Symposium on Networked Systems Design and Implementation, 2009.
30. M. S. Hecht, M. E. Carson, C. S. Chandersekaran, R. S. Chapman, L. J. Dotterrer, V. D. Gligor, W. D. Jiang, A. Johri, G. L. Luckenbaugh, and N. Vasudevan. UNIX without the superuser. In Proc. USENIX Annual Technical Conference, 1987.
31. HyperTransport Consortium. HyperTransport I/O link specification. Doc. no. HTC20051222-0046-0008 rev.3.10, 2006.
32. Intel. Intel trusted execution technology - software development guide. Doc. no. 315168-005, 2008.
33. Intel. Intel's QuickPath architecture: A new system architecture for unleashing the performance of future generations of Intel multi-core microprocessors, 2008.
34. Intel. Intel virtualization technology for directed I/O architecture specification. Intel Pub. no. D51397-005 rev. 1.3, 2011.
35. Jeanne Meserve. Sources: Staged cyber attack reveals vulnerability in power grid. http://edition.cnn.com/2007/US/09/26/power.at.risk/index.html, 2007.
36. G. Klein, K. Elphinstone, G. Heiser, J. Andronick, D. Cock, P. Derrin, D. Elkaduwe, K. Engelhardt, R. Kolanski, M. Norrish, T. Sewell, H. Tuch, and S. Winwood. seL4: formal verification of an OS kernel. In Proc. ACM Symposium on Operating Systems Principles, 2009.
37. B. Lampson. Usable security: How to get it. Communications of the ACM, 52(11):25-27, 2009.
38. H. Langweg. Building a trusted path for applications using COTS components. In Proc. NATO RTS IST Panel Symposium on Adaptive Defence in Unclassified Networks, 2004.
39. B. Laurie and A. Singer. Choose the red pill and the blue pill: a position paper. In Proc. Workshop on New Security Paradigms, 2008.
40. B. Leslie, P. Chubb, N. Fitzroy-dale, S. Gotz, C. Gray, L. Macpherson, D. Potts, Y. Shen, K. Elphinstone, and G. Heiser. User-level device drivers: Achieved performance. Journal of Computer Science and Technology, 20(5):654-664, 2005.
41. Y. Li, J. M. McCune, and A. Perrig. VIPER: Verifying the integrity of peripherals' firmware. In Proc. ACM Conference on Computer and Communications Security, 2011.
42. J. Liu, W. Huang, B. Abali, and D. K. Panda. High performance VMM-bypass I/O in virtual machines. In Proc. USENIX Annual Technical Conference, 2006.
43. J. M. McCune, Y. Li, N. Qu, Z. Zhou, A. Datta, V. Gligor, and A. Perrig. TrustVisor: Efficient TCB reduction and attestation. In Proc. IEEE Symposium on Security and Privacy, 2010.
44. J. M. McCune, B. Parno, A. Perrig, M. K. Reiter, and H. Isozaki. Flicker: An execution infrastructure for TCB minimization. In Proc. European Conference in Computer Systems, 2008.
45. J. M. McCune, A. Perrig, and M. K. Reiter. Safe passage for passwords and other sensitive data. In Proc. Network and Distributed Systems Security Symposium, 2009.
46. B. Parno. Bootstrapping trust in a "trusted" platform. In Proc. USENIX Workshop on Hot Topics in Security, 2008.
47. I. Pratt, K. Fraser, S. Hand, C. Limpach, A. Warfield, D. Magenheimer, J. Nakajima, and A. Mallick. Xen 3.0 and the art of virtualization. In Proc. Ottawa Linux Symposium, 2005.
48. F. L. Sang, E. Lacombe, V. Nicomette, and Y. Deswarte. Exploiting an I/OMMU vulnerability. In Proc. International Conference on Malicious and Unwanted Software, 2010.
49. F. L. Sang, V. Nicomette, Y. Deswarte, and L. Duflot. Attaques DMA peer-to-peer et contremesures. In Proc. Symposium sur la Sécurité des Technologies de l'Information et des Communications, 2011.
50. S. Saroiu and A. Wolman. I am a sensor, and I approve this message. In Proc. Workshop on Mobile Computing Systems and Applications, 2010.
51. R. Schell, T. Tao, and M. Heckman. Designing the GEMSOS security kernel for security and performance. In Proc. National Computer Security Conference, 1985.
52. A. Seshadri, A. Perrig, L. van Doorn, and P. Khosla. SWATT: Software-based attestation for embedded devices. In Proc. IEEE Symposium on Security and Privacy, 2004.
53. N. Shachtman. Exclusive: Computer virus hits u.s. drone fleet. http://www.wired.com/dangerroom/2011/10/virus-hits-drone- fleet/, 2011.
54. T. Shanley and D. Anderson. PCI System Architecture. Addison-Wesley Professional, 4th edition, 1999.
55. J. S. Shapiro, J. Vanderburgh, E. Northup, and D. Chizmadia. Design of the EROS trusted window system. In Proc. USENIX Security Symposium, 2004.
56. T. Shinagawa, H. Eiraku, K. Tanimoto, K. Omote, S. Hasegawa, T. Horie, M. Hirano, K. Kourai, Y. Oyama, E. Kawai, K. Kono, S. Chiba, Y. Shinjo, and K. Kato. Bitvisor: a thin hypervisor for enforcing I/O device security. In Proc. ACM SIGPLAN/SIGOPS International Conference on Virtual Execution Environments, 2009.
57. U. Steinberg and B. Kauer. NOVA: a microhypervisor-based secure virtualization architecture. In Proc. European Conference on Computer Systems, 2010.
58. M. M. Swift, B. N. Bershad, and H. M. Levy. Improving the reliability of commodity operating systems. In Proc. ACM Symposium on Operating Systems Principles, 2003.
59. A. Triulzi. Project Maux Mk.II - "I own the NIC, now I want a shell!". In PacSec/core, 2008.
60. A. Triulzi. The Jedi Packet Trick takes over the Deathstar (or: "taking NIC backdoors to the next level"). In CanSecWest/core, 2010.
61. USB Implementers Forum. On-The-Go and Embedded Host Supplement to the USB Revision 2.0 Specification, Revision 2.0 plus errata and ecn, 2010.
62. P. Varanasi and G. Heiser. Hardware-supported virtualization on ARM. In Proc. ACM SIGOPS Asia-Pacific Workshop on Systems, 2011.
63. A. Vasudevan, E. Owusu, Z. Zhou, J. Newsome, and J. M. McCune. Trustworthy execution on mobile devices: What security properties can my mobile platform give me? Technical Report CMU-CyLab-11-023, Carnegie Mellon University, 2011.
64. T. Weigold, T. Kramp, R. Hermann, F. Höring, P. Buhler, and M. Baentsch. The zurich trusted information channel - an efficient defence against man-in-the-middle and malicious software attacks. In Proc. International Conference on Trusted Computing and Trust in Information Technologies: Trusted Computing - Challenges and Applications, 2008.
65. R. Wojtczuk and J. Rutkowska. Following the white rabbit: Software attacks against intel VT-d technology. http://invisiblethingslab.com/resources/ 2011/SoftwareAttacksonIntelVT-d.pdf, 2011.