Vasily A. Sartakov

Inaugural secure enclave platforms operate at the single user process level (e.g. SGX), meaning a single address space with potentially multiple threads, with a standard OS outside the enclave responsible for resource management and scheduling. More recent platforms (AMD SEV, Intel TDX, AWS Nitro Enclaves) operate at the VM level. This provides significant new capabilities for multi-process abstractions such as mmap and fork, which will be beneficial for enclavizing legacy software.

However, taking a VM image and running it in an enclave is not great from a TCB minimization standpoint. For platforms where there's currently no alternative (AMD, AWS), how can we build--with a minimal TCB--an abstraction that's similar to single-process enclaves? Of course you can “just run Linux” with a single process but this again is clearly suboptimal. We'll explore the solution space in this interactive session.

Other people: Marta Rybczynska Mike Bursell Jo Van Bulck Jethro G. Beekman Hugo Lefeuvre

Hardware and container virtualisations are the fundamental technologies of modern cloud stacks. While these technologies virtualise different layers of software and hardware, they have one common thing: they are quite inefficient in terms of communication between isolated entities. The isolation relies on MMU and involves a privileged intermediary, which leads to heavy transitions or sharing data at the page granularity. The escape from this trap we see in the hardware capabilities introduced in CHERI. The CHERI architecture efficiently combines hardware memory capabilities with conventional MMU architectures. It gives not only safety to memory pointers, but also provides lightweight isolation mechanisms.

In this talk, I will present Introvisor, a lightweight hypervisor for microservices. It uses CHERI capabilities for isolation and data sharing, does not require software porting thus compatible with existing software, and provides strong security guarantees.

A brief introduction to the room and to the sessions.

This year's TEE devroom will again be a full-day virtual event with an impressive lineup! The day will be roughly divided into session blocks grouping related talks as follows:

10h00-12h25: TEE attacks, defenses, and enclave shielding runtimes

featuring an enclave exploit analysis, Guardian, Gramine, Enarx, and Veracruz

13h25-14h40: Emerging TEEs and best practices

featuring logging in confidential computing, secure boot, and ARM CCA

14h55-16h10: OS and and page-based isolation

featuring FlexOS, Intravisor, and EDP for AWS Nitro

16h30-17h30: Wrap up and discussion on process-based abstractions for VM-based environments

we wrap up the day with a live presentation and a following discussion

Other people: Jo Van Bulck Fritz Alder

What if millennials reinvented microkernels? How would they design them, what CPU features would they use?

Modern component-based systems, in particular microkernels, are impractical. While it is relatively easy to develop a small microkernel, it is almost impossible to build a component-based environment that can effectively reuse existing components and programs from mainstream systems. The experience of big projects, like Genode, L4Re, rump-kernel, etc. shows that it is an infinite catch-up game when developers try to reproduce POSIX environment and Linux kernel interfaces, while the mainstream systems are constantly evolving.

In this talk, I will discuss what to do with this infinite loop. I will show, that:

1. the root cause of the problem is the messaging-based API of component-based systems, which is hardly compatible with POSIX but fundamental

2. a monolithic system can be partitioned without the use of messages but requires some constraints in its design and implementation

3. Modern hardware features like Intel MPK gives new opportunities for kernel developers and allows to resolve some old systems problems.

I will present CubicleOS, a sketch of a LibOS based on Unikraft. CubicleOS does not use messages, works as automatic partitioning system, and turns monolithic Unikraft into a set of isolated components.

In this talk I will present EActors, an actor framework that is tailored to SGX and offers a more seamless, flexible and efficient use of trusted execution – especially for applications demanding multiple enclaves. EActors disentangles the interaction with enclaves and, among them, from costly execution mode transitions. It features lightweight fine-grained parallelism based on the concept of actors, thereby avoiding costly SGX SDK provided synchronisation constructs. Finally, EActors offers a high degree of freedom to execute actors, either untrusted or trusted, depending on security requirements and performance demands.

Please note that this talk was originally scheduled to begin at the later time of 12:25

abstract

description

Despite the diversity of microkernel project, most of them are experimental and research. Some of them are positioned as embedded systems, some other as general purpose desktop system. We want to add in this diversity additional project. In contrast with most other, we are interested in network services for clouds. We want to build guest system based on microkernel for providing various network services like cluster file system, key-value store and web server.

This presentation will describe work-in-progress status of process development cloud services on top of microkernels. We will describe main idea, rationale and motivation, main architecture and early results. The talk will provide description and guidance of porting key-value store Redis on top of Genode, development levedb-based in memory KVS on top of L4Re, deployment and use of network services in virtual environment.

Introduction to Microkernels devroom