SaTC: CORE: Medium: Cannot Trust Anything: A Tiny TCB Architecture for Secure Containers

该项目的目标是保护用户在网络空间中的敏感数据不受决心和足智多谋的攻击者的攻击，同时不需要更改应用程序，也不需要用户或软件开发人员采取任何行动。该项目的新奇之处在于它对容器的重新思考，容器代表了一个软件，它包括了应用程序在不同计算环境中运行所需的所有资源。当前的容器技术依赖于操作系统(OS)作为可信计算基础(TCB)来实施其安全保证。然而，像Linux这样的现代操作系统实在太大了，有许多漏洞和恶意软件隐藏的地方。该项目重新设想了带有微小TCB的集装箱，这种TCB足够小，可以仔细检查，甚至可以防御操作系统本身和第三方软件。该项目更广泛的意义和重要性在于：(1)加强现代计算基础设施，即使在计算机基础设施和网络受到不良行为者危害的情况下，仍支持移动、网络和桌面应用程序；(2)扩大代表不足的少数群体对计算的参与。该项目正在研究创造性的解决方案，以保护和捍卫应用程序状态(包括寄存器、物理内存和文件)的机密性和完整性，同时仍支持传统的计算和网络服务。该方法支持从应用程序接收数据和向应用程序返回数据的系统调用和库，而不需要修改应用程序的源代码或开发人员进行特殊配置。该项目将展示这种新的TCB架构针对各种实际攻击提供细粒度的应用程序状态保护，包括传统管理程序和容器架构无法抵御的侧通道攻击，同时仍然只会给实际应用程序工作负载增加适度的性能开销。社会将受益于用户享受他们最喜欢的旧应用程序，并在安全、隐私和安全方面安心地探索流行的新应用程序。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

The goal of this project is to protect users' sensitive data in cyber space from determined and resourceful attackers while requiring no changes to applications and no actions from users or software developers. The project's novelties lie in its rethinking of containers, which represent a piece of software that includes all resources an application needs to run across diverse computing environments. Current container technology relies on the operating system (OS) as the trusted computing base (TCB) to enforce their security guarantees. However, modern OSes like Linux are simply too large, with many vulnerabilities and places for malicious software to hide. The project re-envisions containers with a tiny TCB, small enough to be carefully checked, offering defenses even from the OS itself and third-party software. The project's broader significance and importance are its (i) enhancements to modern computing infrastructure supporting mobile, web and desktop applications even when the computer infrastructure and network have been compromised by bad actors and (ii) broadening the participation of underrepresented minorities in computing. The project is investigating creative solutions to the hard problems of protecting and defending the confidentiality and integrity of application state, including registers, physical memory, and files, while still enabling traditional computing and networking services. The approach supports system calls and libraries that receive data from and return data to the application, without requiring modifications to the application’s source code or special configuration by developers. The project will demonstrate that this new TCB architecture provides fine-grained protection of application state against a variety of real attacks, including side-channel attacks that traditional hypervisor and container architectures cannot shield against, while still adding only modest performance overhead to real application workloads. Society will benefit as users enjoy their favorite old apps and explore trending new apps with peace of mind in their safety, privacy, and security.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.