System Level Architecture for Practical and Efficient Security Analysis

Stanford University, Stanford CA

Investigators

Abstract

This project will develop a system infrastructure that protects existing software from low-level and high-level vulnerabilities. The goal is to synergistically combine hardware and software features in a manner that provides robustness (no false positives or false negatives), flexibility (can evolve to cover future threats), end-to-end coverage (handles user and system code), practicality (works will all types of real world binaries), simplicity (can be easily verified), and good performance (no significant runtime impact). At the hardware level, the system will combine two novel features: support for dynamic information flow tracking (DIFT) and support for isolated execution. DIFT allows the system to track the propagation of untrusted data and code during the execution of a program and prevent any unsafe uses. The goal is to develop hardware support for DIFT that reduces its overhead while allowing software to control and extend its policies. Isolated execution has been used to improve the performance by allowing optimistic parallelization. The goal is to extend isolated execution to support the use of untrusted data and code until their safety is verified. At the software level, the system will provide a runtime environment that will manage and virtualize the hardware security features based on the active security policies. It will also define the interfaces that allow software security tools (static and dynamic) to program, use, and collaborate with the hardware mechanisms. Finally, it will define a domain-specific language for security policies that abstracts out the division of labor between hardware and software security features. To demonstrate this approach, the project will develop a full-system prototype based on an open-source Sparc processor and the open-source Linux operating system. Such a prototype will facilitate an extensive security evaluation using real-world server and client software in an on-line setting.