Trusted I/O Kernel Isolates Secure Application Channels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern secure architectures face challenges in providing on-demand isolated I/O channels to secure applications on untrusted commodity operating systems, limiting their usefulness and viability due to the need for formal verification, which restricts their functionality and compatibility with large, complex systems.
Innovation Solution
The implementation of a trusted I/O kernel (TK) that isolates I/O channels dynamically, executing at a higher privilege level than the OS, outsources I/O functions to the untrusted OS for verification, and exports driver code to secure applications, minimizing the TK's code base while maintaining security and verifiability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If secure applications include basic services (persistent storage, file systems, networking, I/O) to improve usefulness and viability, then their functionality and adaptability improve, but their size and complexity increase making formal verification difficult
Solution Approach 1:
The patent extracts basic services (persistent storage, file systems, networking, I/O channels) from the secure application code base and places them in the untrusted commodity OS. The secure application becomes a minimal verified kernel that only contains critical security functions, while relying on the untrusted OS for non-critical services. This extraction resolves the contradiction by maintaining functionality through external services while keeping the verified code base small and simple.
Solution Approach 2:
The system segments functionality into two distinct parts: a minimal verified secure kernel containing only essential security functions, and external untrusted OS services providing basic functionality. This segmentation allows the secure portion to remain small and verifiable while the functional portion resides in the untrusted environment, resolving the trade-off between size and adaptability.
2Device complexity
If secure applications rely on untrusted OS services to reduce their own code base, then verification becomes easier, but security risks increase from relying on untrusted components
Solution Approach 1:
The patent introduces an intermediary trusted I/O kernel that sits between the secure application and the untrusted OS services. This intermediary verifies and mediates all interactions between the secure application and untrusted components, ensuring that even though the OS is untrusted, the secure application's security requirements are enforced. This resolves the contradiction by allowing small verified code while maintaining security through the intermediary layer.
3Reliability
If a trusted computing base includes all basic services to guarantee safe co-existence, then security assurance improves, but the TCB becomes bloated, unstable, and unverifiable
Solution Approach 1:
The patent extracts basic services from the trusted computing base and places them in the untrusted commodity OS. The TCB is reduced to only essential security functions that must be verified, while non-critical services (file systems, networking, I/O) are moved to the untrusted environment. This extraction resolves the contradiction by maintaining security assurance for critical functions while eliminating bloat from non-critical services.
Solution Approach 2:
The system segments the TCB into a minimal verified core containing only essential security functions, with all other services separated into the untrusted OS. This segmentation allows the TCB to remain small and verifiable while still providing security assurance for the secure application through the intermediary trusted I/O kernel.
4Reliability
If I/O channels are isolated within the TCB to ensure security, then security assurance improves, but the TCB code base size and complexity increase significantly
Solution Approach 1:
The patent introduces a trusted I/O kernel as an intermediary that handles I/O channel isolation. This intermediary manages all I/O operations between the secure application and untrusted OS, verifying and mediating each interaction. By placing I/O handling in this dedicated intermediary layer rather than embedding it throughout the TCB, the system maintains security while avoiding significant increases in TCB code base size and complexity.
Data Source
AI summary
A computing platform for on-demand I/O channels, which enable secure application to dynamically connect to diverse peripheral devices of untrusted commodity OSes.