An X86/64 Separation Kernel for High Assurance
Total Page：16
File Type：pdf, Size：1020Kb
Muen - An x86/64 Separation Kernel for High Assurance Reto Buerki Adrian-Ken Rueegsegger August 29, 2013 University of Applied Sciences Rapperswil (HSR), Switzerland ii Abstract Computer systems are used to store and protect highly sensitive data. At the same time the resources and determination of attackers have increased significantly. Therefore, systems capable of safeguarding critical information must conform to rigorous quality standards to establish trust in the correct functioning. Attaining high assurance for today's monolithic operating systems is exceptionally hard since they tend to be large and include complex functionality. This fact is highlighted by regular security updates provided by operating system vendors. Thus, they are a weak foundation for building secure systems. In contrast, microkernels can be well suited as a basis for systems with strict demands on robustness. They are by definition small, which is a precondition for rigorous verification of correctness. Additionally, they lend themselves to the construction of component-based systems where the incorrect behavior of one partition does not impact the whole system. A separation kernel (SK) is a specialized microkernel that provides an execution environment for multiple components that can only communicate according to a given policy and are otherwise isolated from each other. Hence, the isolation also includes the limitation of potential side- and covert channels. SKs are generally more static and smaller than dynamic microkernels, which minimizes the possibility of kernel failure and should ease the application of formal verification techniques. Recent addition of advanced hardware virtualization support for the Intel x86 architecture has the potential of greatly simplifying the implementation of a separation kernel which can support complex systems. This thesis presents a design of a separation kernel for the Intel x86 architecture using the latest Intel hardware features. An open-source prototype written in SPARK demonstrates the viability of the envisioned concept and the application of SPARK's proof capabilities increases the assurance of the correctness of the implementation. iii iv Acknowledgments Foremost, we would like to express our sincere gratitude to our advisor Prof. Dr. Andreas Steffen for the continuous support in the course of our studies and for the guidance in writing this master thesis. His help and generosity allowed us to work in such an interesting field of research. Many thanks also to our colleagues and friends at secunet Security Networks AG in Germany, Alexander Senier, Robert Dorn and Stefan Berghofer for their tremendous assistance not only during this thesis, but also during the many projects we have realized together. We were able to learn a lot and without their support and immense knowledge in the area of high-security platforms we would not have been able to implement the Muen kernel in such short time. We thank Prof. Dr. Endre Bangerter from the University of Applied Sciences in Bern for being our expert and reviewer. Thanks also to Daniel Bigelow for proofreading the report. Last but not least, many thanks to our families and friends for their support and understand- ing throughout the writing of this master thesis. v vi Contents Abstract iii Acknowledgments v 1 Introduction 1 1.1 Notation . .2 1.2 Related Literature . .2 1.3 Provenance of Name . .2 2 Background 3 2.1 SPARK . .3 2.1.1 Design Rationale . .4 2.1.2 Example . .5 2.1.3 SPARK 2014 . .5 2.2 Intel x86 Architecture . .5 2.2.1 Processor . .5 2.2.2 Memory Management . .7 2.2.3 Exceptions and Interrupts . .9 2.2.4 Programmable Interrupt Controller . .9 2.2.5 Chipset connectivity . 10 2.3 Virtualization . 11 2.3.1 Intel Virtualization Technology (VT) . 12 2.4 Separation Kernel . 14 2.4.1 Subjects . 15 2.5 Motivation . 15 2.6 Goals . 16 2.7 Related Work . 16 2.7.1 seL4 . 16 2.7.2 XtratuM . 16 2.7.3 NOVA . 17 2.7.4 Commercial Separation Kernels . 17 3 Design 19 3.1 Scope . 19 3.2 Requirements . 20 3.3 Subject . 21 3.3.1 Subject Specification . 21 3.3.2 Subject State . 21 vii CONTENTS CONTENTS 3.3.3 Subject Profile . 22 3.4 Architecture . 22 3.4.1 Subject Execution . 23 3.4.2 Policy . 24 3.4.3 Inter-Subject Communication . 26 3.4.4 Exceptions . 27 3.4.5 Interrupts . 28 3.4.6 Multicore . 28 3.4.7 Scheduling . 29 4 Implementation 31 4.1 Policy . 31 4.1.1 Data Types . 32 4.1.2 Hardware . 35 4.1.3 Kernel . 36 4.1.4 Binaries . 36 4.1.5 Subjects . 37 4.1.6 Scheduling . 40 4.2 Zero Footprint Runtime . 41 4.3 Subject . 42 4.3.1 Specification . 42 4.3.2 State . 42 4.4 Kernel . 44 4.4.1 Init . 44 4.4.2 Multicore Support . 46 4.4.3 Scheduling . 47 4.4.4 Interrupt Injection . 48 4.4.5 Traps . 49 4.4.6 External Interrupts . 50 4.4.7 Exceptions and Software-generated Interrupts . 51 4.4.8 Events . 52 4.4.9 Debug . 53 4.5 Build . 54 4.5.1 Subject Binary Analysis . 55 4.5.2 Policy Compilation . 56 4.5.3 Image Packaging . 57 4.5.4 Emulation . 58 4.6 Example System . 59 4.6.1 Subjects . 59 4.6.2 Keyboard Handling . 60 5 Analysis 63 5.1 Separation . 63 5.1.1 VMX Controls . 63 5.1.2 System Resources . 64 5.1.3 Execution Environment . 65 5.1.4 Temporal Isolation . 69 5.2 Information Flow . 70 5.2.1 Shared Memory . 70 viii CONTENTS CONTENTS 5.2.2 Events . 70 5.2.3 Traps . 70 5.3 Architecture Support . 71 5.3.1 Kernel . 71 5.3.2 Subject . 72 5.4 Implementation Assurance . 72 5.4.1 Lean Implementation . ..