Visible to the public Information Flow Control for Distributed Trusted Execution Environments

TitleInformation Flow Control for Distributed Trusted Execution Environments
Publication TypeConference Paper
Year of Publication2019
AuthorsGollamudi, Anitha, Chong, Stephen, Arden, Owen
Conference Name2019 IEEE 32nd Computer Security Foundations Symposium (CSF)
Date Publishedjun
Keywords-distributed-systems, -enclaves, -language-based-security, -security, -trusted-execution-environment, Calculus, compositionality, confidential messages, core security calculus, cryptographic mechanisms, cryptography, data integrity, DFLATE, distributed programming, distributed trusted execution environments, Encryption, encryption audits, Fabrics, high-integrity messages, high-level abstractions, Information Flow Control, information-flow-control, Libraries, messages authentication, Predictive Metrics, Protocols, pubcrawl, Resiliency, TEE, Trusted Computing, untrusted host

Distributed applications cannot assume that their security policies will be enforced on untrusted hosts. Trusted execution environments (TEEs) combined with cryptographic mechanisms enable execution of known code on an untrusted host and the exchange of confidential and authenticated messages with it. TEEs do not, however, establish the trustworthiness of code executing in a TEE. Thus, developing secure applications using TEEs requires specialized expertise and careful auditing. This paper presents DFLATE, a core security calculus for distributed applications with TEEs. DFLATE offers high-level abstractions that reflect both the guarantees and limitations of the underlying security mechanisms they are based on. The accuracy of these abstractions is exhibited by asymmetry between confidentiality and integrity in our formal results: DFLATE enforces a strong form of noninterference for confidentiality, but only a weak form for integrity. This reflects the asymmetry of the security guarantees of a TEE: a malicious host cannot access secrets in the TEE or modify its contents, but they can suppress or manipulate the sequence of its inputs and outputs. Therefore DFLATE cannot protect against the suppression of high-integrity messages, but when these messages are delivered, their contents cannot have been influenced by an attacker.

Citation Keygollamudi_information_2019