Lecture

Architectural Support for Software Security

Speaker:	Prof. Christos Kozyrakis, Stanford University
Date:	Monday, 20 July 2009
Time:	15:00-17:00
Location:	"Mediterranean Studies" Seminar Room, FORTH. Heraklion, Crete
Hosts:	M. Katevenis / D. Nikolopoulos

Abstract:

Despite years of research and development, the security of our software infrastructure is still a critical problem. The breadth and diversity of software vulnerabilities demand new security solutions that combine the speed and practicality of hardware approaches with the flexibility and robustness of software systems. Towards this goal, this talk will describe two full system security prototypes, Raksha and Loki.
Raksha builds on dynamic information flow tracking (DIFT) in order to protect existing binaries vulnerabilities ranging from low-level memory corruptions to high-level SQL injections or directory traversals. At the hardware level, Raksha provides three novel features: programmable security policies that enable software to direct hardware analysis; multiple active security policies that can protect the system against concurrent attacks; and low-overhead security handlers that allow software to correct, complement, or extend the hardware-based analysis without the overhead associated with operating system traps. Apart from describing the hardware and software components of the Raksha, we will discuss the security policies used to provide robust protection without the false positives or false negatives for real-world binaries (including the Linux kernel).
Loki is an architecture that allows for hardware enforcement of application security policies for data access. Loki uses tags on physical resources (memory and devices) to provide a single, unambiguous abstraction for fine-grain access control. Loki helps minimize the trusted code base (TCB) in modern operating systems while enforcing application security policies about data access at minimal runtime overhead. We will describe how Loki interacts with a secure operating system (HiStar) and how the implementation avoids the storage overhead of fine-grain tags.

Bio:

Christos Kozyrakis is an Assistant Professor of Electrical Engineering & Computer Science at Stanford University. He received a BS degree from the University of Crete (Greece) and a PhD degree from the University of California at Berkeley (USA), both in Computer Science. Kozyrakis works on architectures, runtime environments, and programming models for parallel computer systems. At Berkeley, he developed the IRAM architecture, a novel media-processor system that combined vector processing with embedded DRAM technology. At Stanford, he lead the Transactional Coherence and Consistency (TCC) project at Stanford that developed hardware and software mechanisms for programming with transactional memory. He has also investigated security systems and power management techniques for data-centers. Currently, he is a member of the Pervasive Parallelism Lab, a multi-faculty effort to make parallel computing practical for the masses. Kozyrakis is a senior member of the ACM and the IEEE. He has received the NSF Career Award, an IBM Faculty Award, the Okawa Fundantion Research Grant, and a Noyce Family Faculty Scholarship.
More info at: http://csl.stanford.edu/~christos