1. S oftware- H ardware I nformation F low T racking + M ulticore Colleen Lewis & Cynthia Sturton SHIFT+M

2. Goals Design information flow control on multicore message passing Determine the cost of safe communication to CPU performance Low impact to receiving node from malicious sender

3. Asbestos Prevents unauthorized communication Message passing Applications set their policy Single Core

4. Asbestos on Multicore Distributed labels and checks Hardware component + trusted library Message passing OS Hardware OS Hardware OS Hardware

5. OS Hardware OS Hardware OS Hardware OS – Taint Unit Network Hardware – Taint Unit Design

6. Message Request Taint S p1 R p2 Taint Protocol - Simple = ?

7. Problem Sending Process Changes Taint Label Before Responding With Taint

8. Message Request Taint S p1 R p2 Taint Sending Process Modifies Taint Modify Taint

9. OS Hardware OS Hardware OS Hardware OS – Taint Unit Network Hardware – Taint Unit Design

10. Message, round = 2 Request Taint, round = 2 S p1 R p2 Taint, round = 2 Protocol – With Round Numbers Modify Taint

11. Problem Every Message Requires Three Messages

12. OS Hardware OS Hardware OS Hardware OS – Taint Unit Network Hardware – Taint Unit Design

13. Message, round = 2 S p1 R p2 Cache The Taint Check Result Hardware – Taint Unit 2p1p211

14. Problem Buffering Messages Requires Receiving Node CPU Time

15. Message, round = 2 S p1 R p2 Software Costs

16. OS Hardware OS Hardware OS Hardware OS – Taint Unit Network Hardware – Taint Unit Design

17. Message, round = 2 Request Taint, round = 2 S p1 R p2 Taint, round = 2 Hardware Buffer Hardware 1

18. Problem Both Sending And Receiving CPU Time Wasted on Deny

19. Message, round = 2 Request Taint, round = 2 S p1 R p2 Taint, round = 2 Software Costs = ?

20. Quick Deny – Taint Meta Data Send Taint meta data with message Reject if sender has higher number of the most classified labels

21. OS Hardware OS Hardware OS Hardware OS – Taint Unit Network Hardware – Taint Unit Design

22. Message, round = 2, meta = 3 S p1 R p2 Quick Deny – Taint Meta Data 1 Hardware – Taint Unit p126 3 Send > 1 Receive Hardware – Taint Unit p1232 REJECT

23. Problem Quality of Service

24. B = Buffering messages RT = Reading taint to send RT = Reading taint for comparison C = Comparison Message, round = 2 Request Taint, round = 2 S R Taint, round = 2 Software Costs = ?

25. B = Buffering messages RT = Reading taint to send RT = Reading taint for comparison C = Comparison Quality of Service B + RT + C RT Receiver Work Sender Work RT B + RT + C Hardware Buffer RT >> C ~ 1

26. B = Buffering messages RT = Reading taint to send RT = Reading taint for comparison C = Comparison Quality of Service RT B + RT + C Cache Hit or Quick Deny B + RT + C RT Receiver Work Sender Work

27. Communication Rate % Productive WorkCommunication Rate (per node) Message Arrival Rate % Productive Work Message Arrival Rate Allowed Communication % Productive Work % of Allowed Communication All cache hits Some cache hits No cache hits All HW buffering Some HW buffering No HW buffering

28. Simulation Simics – full system multicore simulator Implemented message passing Added latency at nodes to represent –Buffering messages –Reading taint to send –Reading taint for comparison –Comparison

29. Conclusions Message passing is well suited for information flow tracking We can bound the cost of secure communication in a distributed protocol