SaTC: CORE: Medium: Cannot Trust Anything: A Tiny TCB Architecture for Secure Containers

该项目的目标是保护用户在网络空间中的敏感数据免受坚定和足智多谋的攻击者的攻击，同时不需要对应用程序进行更改，也不需要用户或软件开发人员采取任何行动。 该项目的新颖之处在于它对容器的重新思考，容器代表了一个软件，其中包括应用程序在不同计算环境中运行所需的所有资源。当前的容器技术依赖于操作系统（OS）作为可信计算基础（TCB）来执行其安全保证。然而，像Linux这样的现代操作系统实在是太大了，有许多漏洞和恶意软件隐藏的地方。该项目重新设想了一个带有小TCB的容器，小到足以仔细检查，甚至可以从操作系统本身和第三方软件中提供防御。该项目更广泛的意义和重要性在于：㈠增强现代计算基础设施，支持移动的、网络和桌面应用程序，即使计算机基础设施和网络受到不良行为者的破坏; ㈡扩大代表性不足的少数群体对计算的参与。 该项目正在研究创造性的解决方案，以保护和捍卫应用程序状态的机密性和完整性，包括寄存器，物理内存和文件，同时仍然支持传统的计算和网络服务。 该方法支持从应用程序接收数据和向应用程序返回数据的系统调用和库，而不需要开发人员修改应用程序的源代码或进行特殊配置。 该项目将证明，这种新的TCB架构可以针对各种真实的攻击（包括传统虚拟机管理程序和容器架构无法屏蔽的侧通道攻击）提供应用程序状态的细粒度保护，同时仍然只会为真实的应用程序工作负载增加适度的性能开销。 当用户在安全、隐私和安全方面安心享受他们喜爱的旧应用程序并探索热门新应用程序时，社会将受益。该奖项反映了NSF的法定使命，并通过使用基金会的智力价值和更广泛的影响审查标准进行评估，被认为值得支持。

The goal of this project is to protect users' sensitive data in cyber space from determined and resourceful attackers while requiring no changes to applications and no actions from users or software developers. The project's novelties lie in its rethinking of containers, which represent a piece of software that includes all resources an application needs to run across diverse computing environments. Current container technology relies on the operating system (OS) as the trusted computing base (TCB) to enforce their security guarantees. However, modern OSes like Linux are simply too large, with many vulnerabilities and places for malicious software to hide. The project re-envisions containers with a tiny TCB, small enough to be carefully checked, offering defenses even from the OS itself and third-party software. The project's broader significance and importance are its (i) enhancements to modern computing infrastructure supporting mobile, web and desktop applications even when the computer infrastructure and network have been compromised by bad actors and (ii) broadening the participation of underrepresented minorities in computing. The project is investigating creative solutions to the hard problems of protecting and defending the confidentiality and integrity of application state, including registers, physical memory, and files, while still enabling traditional computing and networking services. The approach supports system calls and libraries that receive data from and return data to the application, without requiring modifications to the application’s source code or special configuration by developers. The project will demonstrate that this new TCB architecture provides fine-grained protection of application state against a variety of real attacks, including side-channel attacks that traditional hypervisor and container architectures cannot shield against, while still adding only modest performance overhead to real application workloads. Society will benefit as users enjoy their favorite old apps and explore trending new apps with peace of mind in their safety, privacy, and security.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.