SaTC: Hardware-Assisted Methods for Operating System Integrity

操作系统（OS）构成了大多数计算机平台上可信计算基础的核心。 因此，平台的安全至关重要地依赖于其操作系统的正确和安全操作。不幸的是，恶意软件（如rootkit）通过破坏其代码和数据的完整性来感染操作系统，从而危及整个平台的安全。本项目的目标是推动硬件辅助方法的边界，以确保操作系统的完整性。探索的方法包括：（1）使用本地内存来监控操作系统完整性的混合硬件/软件方案的形式验证，（2）内核内存安全的硬件支持，以及（3）利用ARM TrustZone等方法来监控最终用户设备安全的基于硬件的方案。 在整个过程中，该项目的重点是开发基于硬件的解决方案，以监控操作系统的完整性，并验证这些解决方案所宣传的安全保证。正在开发的方法可以通过推进个人，移动的和嵌入式设备安全的最新技术水平产生广泛的影响。拟议的设计是目前可用的硬件设计的密切变化，因此可能会吸引硬件制造商。该项目还包括在研究生和本科水平的课程增强，以及针对高中学生以及行业专业人士的推广计划。

Operating systems (OS) form the core of the trusted computing base on most computer platforms. The security of a platform therefore crucially relies on the correct and secure operation of its OS. Unfortunately, malicious software such as rootkits infect the OS by compromising the integrity of its code and data, thereby jeopardizing the security of the entire platform.The goal of this project is to push the boundaries of hardware-assisted methods to ensure OS integrity. The methods explored include (1) formal verification of a hybrid hardware/software scheme that uses local memory to monitor OS integirty, (2) hardware support for kernel memory safety, and (3) a hardware-based scheme that leverages methods such as the ARM TrustZone to monitor the security of end-user devices. Throughout, the focus of this project is on developing hardware-based solutions to monitor OS integrity and to verify the security guarantees advertised by these solutions.The methods being developed can have broad impact by advancing the state of the art in personal, mobile and embedded device security. The proposed designs are close variants of currently-available hardware designs and are therefore likely to appeal to hardware manufacturers. The project also includes curriculum enhancements at the graduate and undergraduate level, and outreach programs aimed at high-school students as well as industry professionals.