Creating Security using Software and Hardware Bradley Herrup CS297- Security and Programming Languages

XOM Architecture Execute-Only Memory Creating a Secure Execution Environment Uses Public-Key Cryptology Framework Do not Secure the entire program just the secure parts

An Abstract XOM Machine Has Four Distinct Premises A Scheme to decrypt symmetric keys using private-public keys The Symmetric key act as Session keys Facilities for real-time decryption Instructions for entering and exiting XOM modes Including Interrupts Tagging Systems

Implementing XOM Using a Virtual Machine Possible to implement XOM on a Virtual Machine In either software or hardware So can be run internally on a typical CPU Uses a monitor to maintain assurance

Full XOM Machine enter_xom and exit_xom Must also implement a method of secure_store and secure_load (also referred to as restore_secure) Use of MAC to assure secure transference

Security Issues with XOM Spoofing Attacks Solved using MAC Execution is halted if MAC does not match Splicing Attacks Replacing ciphertext with other valid ciphertext our of sequence MAC includes a destination and location variable Replay attacks Can cause unintentional interrupts which would allow access to area outside XOM

Performance Implications Memory delay of about 100 cycles Memory latency is the greatest delay Using more specialized hardware to decrease the speed elsewhere to compensate for memory latency Leads into SAFE-OPS

SAFE-OPS Software/Architecture Framework for the Efficient Operation of Protected Software Want to be able to create tamperproof, secure and reliable software Can be accomplished by utilizing not only software tactics but also hardware secure designs Face the problems that become addressed in a smaller environment that is not

Hardware Security Smart Cards Tamper Resistant Packaging Secure Coprocessing

Software Security Copyright/ watermarking and stegonography Obfuscation Code and Checksums Proof-carrying code Custom OS Smaller footprints for Embedded Systems

SAFE-OPS Approach Solve the security problem by using optimization techniques Fine-tune code Compiler assistance in helping Give the user the choice as to where to put portions of security On the software side or the hardware However, Secure hardware increases the assurance of the software

Using FPGAS Field Programmable Gate Array Programmable Logic Chip Can be used and instantiated to perform various functions Must be a level of trust insured in the security of the FPGA Can be updated and reconfigured on a whim to move with the ever changing tie of security

Examples of Choice Register Streaming FPGA watches instruction stream and uses said stream to create a key Decryption of sequence created by compiler representing the instruction sequence If both code and key match continue to execute the instructions

FPGA-Instruction Based Caching Use FPGA to reduce operating times as secondary Cache Secondary L2 Cache Secure Block cache Secure Register Sequence Buffer

Discussion