Projects

C5: Security in Invasive Computing Systems

Principal Investigators:

Prof. F. Freiling, Prof. W. Schröder-Preikschat,
in cooperation with Mercator Fellow Prof. I. Verbauwhede

Scientific Researchers:

Dr. T. Müller, R. de Clercq, J. Götzfried, P. Maene

Abstract

Project C5 explores security aspects of invasive computing and resource-aware programming. Invasive MPSoC architectures will only be accepted if basic security properties are supported. The final goal is to ensure confidentiality, integrity, and availability in the presence of untrustworthy programs that compete for resources and/or can contain malicious functionality. This requires a comprehensive approach, addressing both hardware and software mechanisms. C5 is a new project established within the second fundung phase.

Synopsis

The scientific objective of C5 is to embed information flow protection into the invasive computing paradigm through all architectural design layers. Indeed, security and trust can only be provided if there is a chain of trust from the user application down to the hardware component. This concept has two aspects: there should be a correct execution of intended behaviour. But there should also be no loss of information through side-channels. This is specifically important for invasive computing since resource-aware programming offers a multitude of possibilities to convey information over unintended communication channels (side channels or covert channels over shared resources) between applications. The challenge lies in closing (or at least reducing the capacity) of all these channels even when applications share resources in an invasive computing architecture.

Security has a cost and no perfect security exists. Therefore, a critical measure with be the price of security. We will investigate which properties of an invasive platform benefit and which reduce security. As an example, invasion of resources is exclusive by default with run-to-completion semantics. Interestingly, this aspect supports information flow protection by default.

At the application level, we propose to embed information flow protection constraints into the language with which invasive programs formulate their claims. Information flow protection interacts with other requirements of the platform. For instance, stronger degrees of isolation imply more exclusive use of resources, which at the same time could also improve the predictability of execution. As another example, strong information flow protection might require processors at the border of an application to remain idle, and so security constraints can even be used to handle issues of dark silicon without additional performance penalty. We will investigate security requirements in relation with other requirements of invasive hardware.

Approach

The security investigation starts with an attack analysis. Our basic attacker model assumes that basic hardware and systems software are trustworthy, but that the code of invasive applications can be malicious at the level of the X10 programming language. As an example, we assume that Trojans can appear at the application software layer, but not at the hardware layer. The details of the attacker model together with the different levels of isolation will be studied in a separate work package. This again requires close cooperation with the other projects (especially the application projects D1 and D3).

Design for security requires a close interaction between hardware and software design. For instance, certain forms of memory protection can be enforced at compile time. In parallel, techniques to ensure security assuming arbitrary low-level application code (binary exploits) are explored. This is much more demanding and requires additional hardware support. The research challenge is to keep changes to hardware minimal, i.e. establish a provably minimal trusted computing base (TCB), and using the reconfigurability of an invasive architecture to establish this TCB dynamically when needed. The hardware aspects will be the main contribution of the Mercator fellow Ingrid Verbauwhede.

An important aspect of security is evaluation. The effectiveness of the proposed techniques will be analysed analytically as well as empirically by trying to construct covert channels on a real invasive multi-tile hardware architecture as prototyped in Z2. The cost of the different approaches will be compared to each other.

Publications