S oftware- H ardware I nformation F low T racking + M ulticore Colleen Lewis & Cynthia Sturton SHIFT+M

Goals Design information flow control on multicore message passing Determine the cost of safe communication to CPU performance Low impact to receiving node from malicious sender

Asbestos Prevents unauthorized communication Message passing Applications set their policy Single Core

Asbestos on Multicore Distributed labels and checks Hardware component + trusted library Message passing OS Hardware OS Hardware OS Hardware

OS Hardware OS Hardware OS Hardware OS – Taint Unit Network Hardware – Taint Unit Design

Message Request Taint S p1 R p2 Taint Protocol - Simple = ?

Problem Sending Process Changes Taint Label Before Responding With Taint

Message Request Taint S p1 R p2 Taint Sending Process Modifies Taint Modify Taint

OS Hardware OS Hardware OS Hardware OS – Taint Unit Network Hardware – Taint Unit Design

Message, round = 2 Request Taint, round = 2 S p1 R p2 Taint, round = 2 Protocol – With Round Numbers Modify Taint

Problem Every Message Requires Three Messages

OS Hardware OS Hardware OS Hardware OS – Taint Unit Network Hardware – Taint Unit Design

Message, round = 2 S p1 R p2 Cache The Taint Check Result Hardware – Taint Unit 2p1p211

Problem Buffering Messages Requires Receiving Node CPU Time

Message, round = 2 S p1 R p2 Software Costs

OS Hardware OS Hardware OS Hardware OS – Taint Unit Network Hardware – Taint Unit Design

Message, round = 2 Request Taint, round = 2 S p1 R p2 Taint, round = 2 Hardware Buffer Hardware 1

Problem Both Sending And Receiving CPU Time Wasted on Deny

Message, round = 2 Request Taint, round = 2 S p1 R p2 Taint, round = 2 Software Costs = ?

Quick Deny – Taint Meta Data Send Taint meta data with message Reject if sender has higher number of the most classified labels

OS Hardware OS Hardware OS Hardware OS – Taint Unit Network Hardware – Taint Unit Design

Message, round = 2, meta = 3 S p1 R p2 Quick Deny – Taint Meta Data 1 Hardware – Taint Unit p126 3 Send > 1 Receive Hardware – Taint Unit p1232 REJECT

Problem Quality of Service

B = Buffering messages RT = Reading taint to send RT = Reading taint for comparison C = Comparison Message, round = 2 Request Taint, round = 2 S R Taint, round = 2 Software Costs = ?

B = Buffering messages RT = Reading taint to send RT = Reading taint for comparison C = Comparison Quality of Service B + RT + C RT Receiver Work Sender Work RT B + RT + C Hardware Buffer RT >> C ~ 1

B = Buffering messages RT = Reading taint to send RT = Reading taint for comparison C = Comparison Quality of Service RT B + RT + C Cache Hit or Quick Deny B + RT + C RT Receiver Work Sender Work

Communication Rate % Productive WorkCommunication Rate (per node) Message Arrival Rate % Productive Work Message Arrival Rate Allowed Communication % Productive Work % of Allowed Communication All cache hits Some cache hits No cache hits All HW buffering Some HW buffering No HW buffering

Simulation Simics – full system multicore simulator Implemented message passing Added latency at nodes to represent –Buffering messages –Reading taint to send –Reading taint for comparison –Comparison

Conclusions Message passing is well suited for information flow tracking We can bound the cost of secure communication in a distributed protocol