Private application execution

General purpose processors have the great advantage of being able to run many applications side by side and on the same hardware. These processors are used in continuously, larger systems with increasingly, valuable data. Malicious software will attempt to access the data of other applications to exploit this value. A common solution to this problem is enforcing segregation between these applications. For example, an operating system can sandbox different applications, a hypervisor can separate different operating systems or the processor itself can guarantee separation of resources on hardware level.

One common theme through these solutions is that there is one root of trust which has all the privileges. For example, in the case where an operating system sandboxes different applications, the operating system is the root of trust which restricts the resources of the applications. Thus, the operating system enforces that the applications cannot access each other's data; the operating system controls all the data and delegates only parts of it to each application. One caveat of such a system is that if the root of trust is compromised then every application and all the data on the device is compromised. In modern systems, the chance that there is a vulnerability in an operating system that can be exploited by malicious software is quite high.

This research proposal aims to look at still enforcing the data separation, but not necessarily relying on one root of trust to do so. On a hardware level, we can allow applications to keep data secret from the operating system. In this case, the operating system may still allocate resources, but the hardware can enforce that it cannot read the content of an application's data. Keeping application code and data secret, will be called private application execution. One example for why this would be useful is if an app contains the Bitcoin private keys on a person's phone. They would not want those private keys to be leaked if the mobile operating system is compromised and lose all that value. In security terms, private application execution would protect the confidentiality of the application's data from the operating system and the rest of the applications.

The research will be done on the CHERI platform, which has been developed by the Computer Laboratory in Cambridge. On this platform, different approaches to private application execution can be verified and compared. Additionally, as opposed to the closed-source implementation which exists as Intel's Software Guard Extensions (SGX), information about this research can be published and scrutinized by academia.

In a world where privacy and security are becoming more important the principle of least privilege is a useful concept to limit the impact of an attack. This principle should also apply to the operating system and therefore private application execution is a promising concept to limit the data that the operating system has access to.