Using Hypervisor to Provide Data Secrecy for User Applications on a Per-Page Basis

1. Using Hypervisor to Provide Data Secrecy for User Applications on a Per-Page Basis Jisoo Yang EECS/CSE University of Michigan Jisoo Yang and Kang G. Shin University of Michigan

2. Traditional Application Protection • Applications are protected from each others • Result of OS’s process isolation • Isolates fault/malice from other applications • Applications have to trust OS • The OS forms Trusted Computing Base (TCB) • Unprotected from OS’s fault/malice • trusted != trustworthy • Operating system isolates processes • By assumption, the OS must be fully trusted Application Process Application Process Operating System

3. Problems of Trusting Operating System • Modern OS is hard to secure due to its immensity and diversity • Once compromised, OS becomes a powerful tool for stealing user data Infeasibility of fully- verifying large code base Undetected bugs and vulnerabilities Difficulty of auditing every code from diverse sources Malicious code stealing user’s private data Privilege and omnipotence of operating system No effective defense once compromised

4. Our Approach: A New Layer of Protection • Remove the need to trust OS • Enable smaller TCB • Rebalance OS’s power • Separate protection from management • Invent a new protection system that can directly protect user data • It prevents exposure of applications’ data even if the OS is compromised Goals Application Application Operating System New Protection System

5. Scope of This Work • how to reduce/remove operating system from application trust base • programming interface for privacy sensitive apps • separating protection from management • data secrecy (privacy) This work IS about This work IS NOT about • information flow control, trusted computing (i.e., TCG’s TPM) • retrofitting protection to existing ‘insecure’ apps • guaranteeing availability • data integrity (already many good solutions)

6. Related Work • Memory integrity protection • SecVisor [Seshadri, SOSP 07] • XOM, Proxos, Overshadow, Manitou • Trusted Computing • TCG’s TPM • Untrusted OS on trusted hardware • XOM/XOMOS [Lie, SOSP 03] • Cerium, TrustNo1. • VMM-based solutions to control trust • Proxos [Ta-Min, OSDI 06] • Overshadow [Chen, ASPLOS 08]

7. Outline • Background • SP3 Protection System • Implementation • Evaluation

8. Design of a Protection System Design Objectives Design Principles

9. SP3 Protection System • SP3 uses page-granular encryption and decryption • SP3 renders decrypted view of pages to each SP3 protection domain SP3 protection model Encrypted view of pages • Principal: SP3 Domain • Identified by an SID number • SP3 keeps context of current domain • Encryption on each page • Use of symmetric cryptography • Extended PTE to link to a key • Safe key control • Allow OS to link key to pages • But never reveal the key string Inside of an SP3 domain Decrypted view of pages

10. SP3 Architecture • Three functional groups that maintain domain boundary • SP3 is presented as an ‘extension’ to a general processor SP3 Constituents • Secure Paging • Renders decrypted view • Extends PTE and MMU • Secure Domain Switch • Crosses domain boundary safely • Extends interrupt semantics • Domain Operation • Creates/deletes SP3 domains • Transfers key permissions

11. SP3 Paging Extension • KID value is the index to key database that contains actual keys • Page table entry (PTE) is extended to contain KID field to locate key • SID-KID permission bitmap decides which domain can use which key Rendering Mechanism for Decrypted Page View Page Table Extended PTE Structure Phys Addr. KID Flags Memory Access sp3_paging(pte* p) { int kid = get_kid(p); int sid = current_sid(); if (sid has kid permission && kid !=0 ) { key k = get_key(kid); render(decrypt(k,p)); } else { render(p); } } Decrypted Image Decryption Key Database Y ? Current SID N Verbatim Image Permission Bitmap

12. SP3 Paging Illustration Memory Pages Seen Through the Virtual Address Space 1000 1001 1002 1003 1004 1005 1006 1007 Virtual Address Domain 0 KID Domain 1 Domain 2 SID Current Domain (Current SID) SID-KID Permission Map Page Table

13. Secure Domain Switch • Interrupts and exceptions cause the change of SP3 domains • By encryption, SP3 domain contexts are saved securely upon interrupts Restore Domain 1 Context Exception Domain1 Secure Interrupt Return Secure Interrupt Schedule Domain 2 Domain0 (Operating System) Schedule Domain 1 Handle Exception Secure Interrupt Return Domain2 Restore Domain 2 Context

14. SP3 Domain Operations • Four primitive operations that controls the domain dynamics • Using PKI, keys are delivered securely to SP3 without exposure to OS

15. Summary: SP3 Protection System Coming up is SP3 realization using a hypervisor

16. Outline • Background • SP3 Protection System • Implementation • Evaluation

17. Where to Implement: Hypervisor • Safe perimeter • More privileged than OS • Intercepts sensitive operations • Efficient emulation • SP3 ‘extensions’ are virtualizable • ‘shadow page’ to cut overhead • Easy deployment • No need for special hardware • Deployable to existing systems • SP3 must be positioned below the operating system • Hypervisor (VMM) serves as an ideal SP3 implementation point Hypervisor provides User Application User Application Operating System SP3 on Hypervisor Hardware

18. Virtualizing SP3 Semantics Original Hypervisor Secure Domain Switch Domain Operation App VMM OS App VMM OS App VMM OS Ring 3 Ring 0 Ring 1 Ring 3 Ring 0 Ring 1 Ring 3 Ring 0 Ring 1 SP3 domain operation Exception Exception Secure Domain Switch Handles exception Handles domain operation Handles exception Secure Domain Switch Domain n Domain 0 Domain n Domain 0

19. Page frames of physical memory Rendering Decrypted Image • Keep replicas of a page: Replicas hold decryption of the original page • Shadow page: Hypervisor redirects PTE to point to replica page Page Frame Number (PFN) Replica page of page #2 Memory reserved by hypervisor 6 {P}-1K1 5 4 Hypervisor’s real page table Guest VM’s view of page table 3 P Memory allocated to guest OS 2 3 … … 2 1 K1 1 Key Database 0

20. Implementation SP3 version of Linux applications Application Samples User Applications C library / toolkit tailored to SP3 C library / Binutils Development Support 1k+ lines were added/modified Linux 2.6.10 Operating System 3k lines for SP3 10k lines for crypto Xen 2.0 Hypervisor Defined extended x86 architecture x86 PC Hardware Platform

21. Outline • Background • SP3 Protection System • Implementation • Evaluation

22. Performance Experimental Setup Evaluation Result

23. Impact of Memory Footprint • Performance degradation mostly comes from PTE re-evaluation • Performed micro-benchmark varying dynamic memory footprint

24. Conclusion Presented is the SP3 data privacy protection system that can protect private user data even when the OS is compromised The hypervisor-based SP3 realization shows that applications can benefit from data privacy protection with negligible penalty in performance SP3 introduces new opportunities of information protection since SP3 serves as the foundation for separating information protection from management

25. Questions? Thank You!