Parallelizing Security Checks on Commodity Hardware

1. Parallelizing Security Checks on Commodity Hardware E.B. Nightingale, D. Peek, P.M. Chen and J. Flinn U Michigan

2. Overview • Introduction • Speculator • Design • Parallel lifeguards • Evaluation • Conclusion

3. Introduction • Security checkers (lifeguards) are too slow (~30X with taintcheck) • Multi core systems are increasingly popular • Can we exploit idle cores to improve lifeguard performance • Speck (Speculative Error ChecKing), parallelizes lifeguards to improve performance

4. Introduction (2) • Security checks are decoupled from application execution • Security checks are executed in parallel on separate cores • Speculator for speculative execution and rollback

5. Speculator • OS level support for speculative execution and rollback • Checkpoint process state before system call execution • Use buffering to hide side effects (e.g I/O) of speculative execution • Block process if cannot hide side effects • Rollback to checkpoint state if necessary

6. Speck Design • Fork instrumented clones of monitored application to run on other cores • Security checks run on instrumented clones • OS logging to handle non deterministic execution e.g signal delivery, system call results • Speculator for speculative execution and rollback of system call

7. Design

8. Parallel Lifeguards • Process Memory Analysis • System Call Analysis • Taint Analysis

9. Parallel Process Memory Analysis • Security violations can be detected in memory • Decrypted virus image • Leaked data • Check each store location for pattern • All checks are independent • Easy to parallelize

10. Parallel System Call Analysis • Analyze program behavior using system calls • Check system call parameters • Check system call history • Checks are independent • Easy to parallelize

11. Parallel Taint Analysis • Detect critical use of malicious input • Track propagation of input • Pin based sequential taintcheck is 18X • Checking is inherently sequential and hard to parallelize • Log based approach to parallelize • Parallel log generation by instrumented clones (workers) • Sequential log processing by master

12. Parallel Taint Analysis Workers • Generate log segments from replayed execution • Eliminate redundant log records using mark and sweep algorithm (6X compression ratio) • Send compressed segments to master for processing

13. Parallel Taint Analysis Master • Maintains metadata • Process segments in log order • Detects violations • Update metadata

14. Evaluation • 8-core (quad dual core) Intel Xeon • 2.66 GHz, 4GB RAM, 8MB L2, 1.33 GHz bus • Linux 2.6 (64 bit) kernel • 4-core (2 dual core) Intel Xeon • 2.8G Hz, 3GB RAM, 4MB L2, 800 MHz bus • Linux 2.4 (32 bit) kernel

15. Benchmarks • Process memory analysis • Frames per second of mplayer playing Harry Potter trailer • System call analysis • Transactions per second (TPS) of Postmark benchmark • Taint Analysis • Frames per second of mplayer playing Harry Potter trailer

16. Process Memory Analysis

17. System Call Analysis

18. Taint Analysis

19. Conclusion • Speck parallelizes security checks on commodity hardware • Pin based lifeguards • OS level support (Speculator) for speculative execution of system call • Speedups with (4 workers, 8 workers) • Process memory analysis (4X, 7.5X) • System Call Analysis (3.3X, 2.8X) • Taint Analysis (1.6X, 2X)