Trusted Execution Environments With Verified Compiler Guarantees
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Formal verification of Trusted Execution Environments (TEE) for functional correctness is prohibitively costly and lacks guarantees on compiled code, despite the use of source-level verification tools, leaving them vulnerable to attacks.
Innovation Solution
A formalized programming framework using memory compartmentalization and certified compilers to verify u-objects, ensuring that properties verified at the source level hold on compiled code, enabling end-to-end security guarantees through compositional verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If formal verification of TEEs is performed using source-level verification tools, then verification can be performed at the source level, but the verification cost is prohibitively high and guarantees do not extend to compiled code
Solution Approach 1:
The patent segments the verification process into two distinct parts: source-level verification using automated tools and compiler verification. This segmentation allows each part to be verified separately, reducing the overall complexity and cost while maintaining end-to-end guarantees. The compiler itself is verified to preserve verification guarantees from source to binary level.
Solution Approach 2:
The patent introduces a verified compiler as an intermediary between source-level verification and binary-level execution. This intermediary compiler has been formally verified to preserve verification guarantees, thereby extending the reliability from source code to compiled code without requiring direct verification of the entire compilation pipeline.
2Reliability
If source-level verification tools are used to verify TEEs, then verification can be performed, but the verification process is time-consuming and expensive
Solution Approach 1:
By segmenting verification into source-level and compiler-level components, the patent enables parallel verification processes. The compiler can be verified once and reused for multiple compilations, significantly reducing the time required for repeated verification tasks compared to verifying entire compilation pipelines each time.
Solution Approach 2:
The patent performs preliminary verification of the compiler itself before use. This preliminary action of verifying the compiler once creates a reusable verified component that can be applied to multiple source codes, reducing the overall verification time for subsequent projects.
3Reliability
If source-level verification is performed, then verification guarantees are obtained for source code, but these guarantees do not hold on the compiled code
Solution Approach 1:
The verified compiler acts as a trusted intermediary that preserves verification guarantees from source to binary. The compiler's verified properties ensure that it does not introduce security violations during compilation, thereby maintaining end-to-end verification guarantees across the entire compilation pipeline.
Solution Approach 2:
The patent establishes a feedback loop where the verified compiler's properties are used to validate that binary code maintains the verification guarantees of the source code. This feedback mechanism ensures that no verification guarantees are lost during compilation by continuously checking that the compiler preserves security properties.
Data Source
AI summary
Disclosed herein is a formalized programming framework using memory compartmentalization and other properties of certified compilers to provide that security guarantees verified at the source level also hold on the compiled code. A trusted execution environment formulated as a collection of objects that access separate memory locations and conform to a public interface.