AppControl: Enforcing Application Behaviour through Type-Based Constraints

Background: The Problem

With the current state of the art, it is possible to limit the access privileges of a third-party program running on a computer system. The addition of architectural capabilities such as provided by CHERI enable unprecedented fine-grained memory protection and isolation. These mechanisms are however not sufficient to control the behaviour of a program so that it follows the intended specification. For example, if a program performs network access, it is not possible to ensure that the network location accessed is intended by the developer, or the result of a backdoor in the system. In general, this is the case for any system call performed by the program. As a result, malicious programs can e.g. participate in DDoS attacks, or send information about the system to a Command and Control server, etc. It is also the case for library calls, which could perform unspecified actions within the memory space of a process.

Project Aim

The aim of this project is to enhance the provision of Digital Security By Design for mission-critical Systems-on-Chip through Capability hardware-enabled Design-by-Specification. What this means is that the Systems-on-Chip has a formal, executable specification (typically created by the system architect), and every software component of the SoC is forced to adhere to this specification. Programs with incompatible specifications cannot run; unspecified run-time behaviour will raise an exception. For the above example, the specification could govern the network access and also the access to system information.
The practical realisation of this aim is through the extension of programming languages to supports expressive specifications and a toolchain which ensures that the specifications are enforced at run time on Capability hardware.

Key Ideas in a Nutshell

Our vision of how to achieve this goal is through the use of behavioural type systems, i.e. the specification of the SoC and each of its individual components are expressed as a type, which effectively and formally describes the allowed interfaces and interactions of each component. This type-based specification will be an integral component of the program executable, and be validated against an overall system specification by the operating system.
This proposal focuses on software components, and will build on the capability hardware for enforcement of the type-based specifications. The type-based Design-by-Specification of hardware components is the topic of the EPSRC Border Patrol project (EP/N028201/1), which will run until 2023 and therefore present great potential for synergies with the current proposal.

Prior Work

In our current EPSRC project Border Patrol (EP/N028201/1) we investigate digital security by design for the design of hardware IP-core based SoCs. The key mechanism is the use of type-driven design-by-specification. A design's specification is encoded in the type system, so that the implementation must follow the specification. Adherence to the spec can be enforced at design time for trusted modules, and at run time for untrusted modules by patrolling the untrusted module's borders with FSM-based run-time type checkers.

AppControl will have major impact through the adoption of our enforceable specifications technology to enable software based security for CHERI based architectures such as the Capability Hardware Morello board being designed by Arm. The use of of our approach will dramatically increase safety and security of smart devices and enable novel product developments. These outcomes will have impact on both society and economy, by helping to protect such future Capability processor based systems utilised in many areas ranging from critical infrastructure to home appliances from cyber attacks. We have identified nine activities to realise the economic, societal and academic impacts of this project. The majority of these activities are pathways to adoption by industry and dissemination in academia as those will have the major impact. However, several of the activities also serve as direct pathways to impacts on Knowledge and People. The Management Team (PIs at Glasgow, Essex and Imperial) will ensure that the impact activities are on track and deliver the relevant outcomes, through quarterly reviews. The progress of the impact activities will also be monitored through the yearly audit meeting of the steering group formed by the management team and the industrial partners.

(1) Validation Exemplars: The most important way to ensure that our research can deliver its promise impact, to the embedded systems community in general, industry and to the ISCF programme in particular, is to build a exemplars of the technologies that showcase the capability enabled by the use of enforceable specifications for secure Systems-on-Chip. Using our technologies, tools and methodologies to create a proof-of-concept exemplars for the Morello boards designed by Arm, which will enable us to demonstrate convincingly the capabilities of our novel approach. This activity is a prerequisite for activities 4, 5 and 6, and will have a major impact on the other activities as well.
(2) Open-Source Community Project: We believe that the most effective way to achieve impact is to share our type system and compilation system under an open source license, via a community development project (hosted e.g. on GitHub).This approach allows users to implement our type system or similar approaches in their own systems, and allows us to invite contributions to improve the compilation system. By taking charge of the management and hosting of the project, we can direct the development and ensure the quality of the releases.
(3) Engaging with Industrial Partners:to accelerate adoption in industry, there will be a close collaboration with industrial partners (Arm, NASA JPL, UltraSoC, cfr. Letters of Support).
(4) Commercialisation: for some outcomes of the research, technology licensing or other forms of IP commercialisation are a better choice than open-source distribution.
(5) Public Engagement and STEM Activities
(6) Postgraduate Skills and Training: AppControl has an important role to play in developing and sustaining the UK skill base in compiler and run-time development for Capability-based SoCs as well as type theory, both research areas where the UK is at the forefront of the international research scene.
(7) Dissemination Workshops, Tutorials and Lectures: Because our work focuses on highly innovative type systems it will be of great relevance o the programming languages and compilers research, as well as the computer architecture and cybersecurity communities.
(8) Research Publications:To maximise the academic impact we shall publish our research in the most respected journals and conferences in the area
(9) Networking