Trusted Passages: Managing Trust Properties of Open Distributed Overlays Faculty: Mustaque Ahamad, Greg Eisenhauer, Wenke Lee and Karsten Schwan PhD Students: Martim Carbone, Jiantao Kong, Bryan Payne and Ramesh Viswanath Funded by Intel and NSF.

Scenario: HTTPD/Proxy/Client

Assumptions and Challenges Hypervisor and Dom0 trusted User domains could be compromised –Compromised domains may leak data, return incorrect results or may not return results Trust controllers running in Dom0 detect and contain the effects of compromised domains How do we build trust controllers? –Online monitoring to determine when a user domain’s behavior indicates degraded trust –Enforcement of data protection policies –Maintaining desired trust levels

Current Research Application specific monitoring of user domains Protecting confidential data –Trust Bus Meeting trust needs of distributed applications –Trusted Passages

Application-Specific Monitoring Monitor data that is specific to each app –E.g., HTTPD: network (request, response), application binary, process image, data flow Transparent monitoring of different types of operating systems (e.g., Windows, Linux) –Provide common API for accessing information in each operating system Minimize impact on system performance, maximize rate that we can access data Trust aware measurements

Web Server Example Is process image correct? Are network request and replies allowable, and in sync with each other? Normalize timing of network traffic. Is data altered going to or from app? Does disk access correspond with the request?

Performance Page table lookup is slow (LRU cache helps) –Average of 74.9  sec for cache miss –Average of 29.1  sec for cache hit Memory copy is fast (it’s just a mmap’d page) –Average of 1.2 for  sec 1000 bytes

Providing Data Confidentiality and Integrity Confidentiality –Trust controller in dom0 enforces policy on VM device access based on policy file –Header level inspection Integrity –Replication and quorum to check part answers –Ringers and quiz to test if a VM returns correct results

Trust Controller Overheads

Dynamic Maintenance of Trust Detecting result “integrity” via replication of computation at multiple nodes Choosing worker nodes based on trust levels and adding new nodes when trust goes below certain threshold Trust controller can provide trust values for its VMs Evolving trust relevant observations into trust values

Conclusions “Trusted Passages” extends trust across nodes to support distributed applications Trust controllers observe virtual machine execution to derive trust values Application specific monitoring of virtual machines provides observations for trust controllers TrustBus enforces protection policies Dynamic trust evolution and trust management