Collaborative Research: SaTC: CORE: Medium: Leakage-free Isolated Execution: Architectures and Security Models

隔离执行是一种硬件支持的安全模型，用于保护程序不受云等不可信系统的损害。该项目将开发下一代隔离执行系统，以提高三维技术水平。该项目将开发一个正式的理论框架来研究攻击和防御，并基于可组合资源的概念开发针对侧信道攻击的新解决方案。这个项目分为三个部分。首先，将探讨基于可组合资源let的新思想的隔离执行环境中的侧通道泄漏防御：这些是细粒度资源，可以组合起来创建隔离的资源分区以保证安全性。其次，隔离执行的概念将扩展到CPU之外，以覆盖异构系统。最后，将引入新的形式，允许对漏洞和防御进行推理，以达到强有力的安全保证。cpu的隔离执行在产品中可用，并继续受到商业和研究的关注。该项目将通过提供对侧信道攻击的保护，并将其扩展到CPU之外，以在现代异构系统中运行，从而大大提高隔离执行系统的安全性和适用性。这个项目将为代表性不足的学生提供研究机会。将开发有关隔离执行和异构系统安全的新教材，并将其整合到课程中。项目存储库（可在https://github.com/seas-ucr/LFIE上获得）将在赠款结束后至少维持3年。它将保存项目的所有软件副产品。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Isolated execution is a hardware-supported security model used to protect programs from compromised or untrusted systems such as on the cloud. This project will develop next generation isolated execution systems that improve state-of-the-art along three dimensions. This project will develop a formal theoretical framework to study attacks and defenses and develop new solutions against side channel attacks based on the concept of composable resources.This project is organized into three thrusts. First, defenses against side channel leakage in isolated execution environments based on a new idea of composable resource-lets will be explored: these are fine-grained resources that can be combined to create isolated resource partitions for security. Second, the notion of isolated execution will be extended beyond a CPU to cover a heterogeneous system. Finally, new formalisms that allow reasoning about both vulnerabilities and defenses to reach strong guarantees of security will be introduced. Isolated execution for CPUs is available in products and continues to receive commercial and research interest. This project will substantially improve the security and applicability of isolated execution systems by providing protection against side channel attacks and by extending them beyond the CPU to operate in modern heterogeneous systems. This project will provide research opportunities for underrepresented students. New educational material on isolated execution and heterogeneous system security will be developed and integrated into classes.The project repository (available at https://github.com/seas-ucr/LFIE) will be maintained for at least 3 years beyond the end of the grant. It will hold all software byproducts from the project.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.