Towards End-to-End Security Analysis of Networked Systems Extending protocol analysis to include secure system primitives Deepak Garg, Jason Franklin, Dilsun Kaynar, and Anupam Datta

Virtual Machine Monitor Secure Hamburgers User Level Programs Malicious Mustard Lettuce Operating System Layer diagrams specify both interfaces and dependences Virtual Machine Monitor Hardware * My apologies to any vegetarian or hungry members of the audience.

… Networked Secure Hamburgers Virtual Machine Virtual Machine Client Malicious Mustard Virtual Machine Virtual Machine … Malicious Mustard Client Virtual Machine Monitor Malicious Mustard Memory Hardware Secure Co-processor Feisty Fries

Logic of Secure Hamburgers Malicious local threads can corrupt unprotected data and code Malicious Mustard Killer Ketchup Key: Control Flow Hardware Resets Trusted Computing Technology old NEW!!! Memory Memory Protection Time As a first step towards model and analyzing networked secure systems we have added memory + memory protection etc… Prove you are safe from the killer ketchup… Threads Network Comm. Crypto.

Verifying Implementations Checking implementations using model checkers (have found attacks against a security hypervisor SOSP Seshadri 07] Found vulnerabilities in hypervisor design and implementation

Hungry for More? CMU Theory of Secure Systems Project http://www.cs.cmu.edu/~jfrankli/toss