Trusted Verifier for User-Verifiable Code Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Commodity operating systems and applications lack assurance of security-sensitive code and data integrity due to increased complexity, object code compatibility, and mixed-provenance code bases, making them vulnerable to malware and difficult to verify for security properties.
Innovation Solution
The system provides user-verifiable execution of security-sensitive code on untrusted platforms by using a trusted verifier for attestation, minimizing secrets, and employing hardware and software-based attestation mechanisms to ensure code integrity and confidentiality, even in the presence of malware, with a focus on usability and compatibility with current environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If commodity operating systems increase in size and complexity to support plug and play code and maintain object code compatibility, then adaptability and ease of operation are improved, but verification of code integrity and security properties becomes impossible
Solution Approach 1:
The patent divides the operating system code base into discrete, verifiable modules or components. Each module can be individually verified for security properties while the system maintains overall adaptability through the ability to load and execute multiple modules. This segmentation allows verification of individual components without requiring verification of the entire complex system.
Solution Approach 2:
The patent introduces an intermediary verification mechanism or trusted execution environment that mediates between the complex operating system and the verification process. This intermediary provides a controlled interface through which code integrity can be verified without requiring direct access to or verification of the entire operating system code base.
2Ease of operation
If operating systems retain object code compatibility for applications, then ease of operation is improved, but security flaws in APIs become immutable and cannot be eliminated
Solution Approach 1:
The patent extracts or isolates security-critical API operations from the general operating system code base. By separating these security-sensitive functions into distinct, verifiable components, the system can maintain compatibility with existing applications while applying enhanced security verification specifically to the extracted security-critical portions.
Solution Approach 2:
The patent applies different quality standards to different parts of the system. Security-critical API regions are subjected to rigorous verification and security properties, while non-critical regions maintain standard compatibility. This local differentiation allows the system to enforce high security standards where needed without compromising overall application compatibility.
3Adaptability or versatility
If operating systems support mixed-provenance code bases from different development organizations, then adaptability is improved, but global guarantees of security properties cannot be provided
Solution Approach 1:
The patent segments the code base by provenance, allowing each development organization's code to be independently verified and tagged with its security properties. This segmentation enables the system to support mixed-provenance code while maintaining traceability and verification of each component's security characteristics without requiring a single global security guarantee.
Solution Approach 2:
The patent implements feedback mechanisms that track and verify the security properties of code from different provenance sources. Each code module provides feedback about its security attributes, allowing the system to aggregate and verify security properties across mixed-provenance code bases through continuous monitoring and validation.
4Adaptability or versatility
If continuous extension of code base with new modules is performed, then adaptability is improved, but verification of penetration resistance becomes ineffective when code exceeds one million lines
Solution Approach 1:
The patent segments the continuously growing code base into manageable, verifiable units or modules. Each segment can be independently analyzed for penetration resistance, allowing verification to scale with system extensibility. This modular approach prevents the verification difficulty from compounding as the overall system grows beyond one million lines.
Solution Approach 2:
The patent applies preliminary verification actions to code modules before they are integrated into the larger system. By verifying penetration resistance at the module level before integration, the system maintains effective verification capabilities even as the overall code base continuously expands, preventing verification difficulty from accumulating.
Data Source
AI summary
A computer including a processor and a verification device. The processor in the computer performs the steps of authenticating a secure connection between a hypervisor and the verification device, measuring the identity of at least a portion of a select guest before the select guest executes any instruction, and sending a measurement of the identity of the select guest to the verification device. The verification device compares the policy stored in the verification device with the measurement of the select guest received by the verification device. The steps of authenticating, measuring, sending, and comparing are performed after receiving a signal indicative of a request to execute the select guest and without rebooting the computer.